b527325b59a4ccd13a7a685da4d0599eac4c87da03ca7d821cb1a5a5b8b60925

Sharing

Copy URL Twitter E-mail

General

Target

b527325b59a4ccd13a7a685da4d0599eac4c87da03ca7d821cb1a5a5b8b60925
Size

1.6MB
MD5

574b4363e11e7d0909857f036fba3d76
SHA1

c2681954b8f72fd1bfc2c34c5c2313ac0913959e
SHA256

b527325b59a4ccd13a7a685da4d0599eac4c87da03ca7d821cb1a5a5b8b60925
SHA512

9b55252a7b3473b830abc850b58354a54b1e21b22e779a97222dcc153c50615d2bec1142a5cff5d3549b0d93335a558fcf21f212d86a391af8f4c3bf95ff8d8e
SSDEEP

24576:aSktR5EVP8ldi2zslNWm3QrElcLbCETzlPjgbbkJTOMrLAfjcuasD7gXx6D:aR7k0dRsWmgquxzNjOkEMEH3gX

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

b527325b59a4ccd13a7a685da4d0599eac4c87da03ca7d821cb1a5a5b8b60925
.exe windows x86

01ef3bfb5ee237ccb65d53a66919cc60

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rasapi32

RasHangUpA

kernel32

GetTickCount
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

SetClipboardData
MessageBoxA

gdi32

SetViewportOrgEx

winmm

midiStreamRestart

winspool.drv

OpenPrinterA

advapi32

RegQueryValueA

shell32

ShellExecuteA

ole32

CreateILockBytesOnHGlobal

oleaut32

VariantClear

comctl32

ord17

oledlg

ord8

ws2_32

inet_ntoa

wininet

InternetCloseHandle

comdlg32

GetOpenFileNameA

Sections

.text
Size: - Virtual size: 505KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.6MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01ef3bfb5ee237ccb65d53a66919cc60

Headers

File Characteristics

Imports

rasapi32

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

ws2_32

wininet

comdlg32

Sections

.text Size: - Virtual size: 505KB

.rdata Size: - Virtual size: 1.1MB

.data Size: - Virtual size: 187KB

.rsrc Size: 8KB - Virtual size: 22KB

.vmp0 Size: - Virtual size: 139KB

.vmp1 Size: 1.6MB - Virtual size: 1.5MB

.reloc Size: 4KB - Virtual size: 204B

.text
Size: - Virtual size: 505KB

.rdata
Size: - Virtual size: 1.1MB

.data
Size: - Virtual size: 187KB

.rsrc
Size: 8KB - Virtual size: 22KB

.vmp0
Size: - Virtual size: 139KB

.vmp1
Size: 1.6MB - Virtual size: 1.5MB

.reloc
Size: 4KB - Virtual size: 204B