faa2da00d5c848a1c95dfa411869c11e730afeb15b20ce16d8030f3a5acedaa0

Sharing

Copy URL Twitter E-mail

General

Target

faa2da00d5c848a1c95dfa411869c11e730afeb15b20ce16d8030f3a5acedaa0
Size

1.9MB
MD5

d7daf8c2e0f4c05a94306bc0154ed02c
SHA1

501f2b44f8c135b2d5cf4d45f82850f9d3b685ca
SHA256

faa2da00d5c848a1c95dfa411869c11e730afeb15b20ce16d8030f3a5acedaa0
SHA512

258ecf52f983ee87fffa43656691589de5a04cc8c81ea95bbc39627ef1039ab463ecac96cf1138b7b31d8cb35eb0008b13b13ca305c39c7eb6e3b6341fbe2063
SSDEEP

49152:P2HvfdgzAxyBEk2QeyyaOz9Cj0FwWSPEte47Di+nuJ4FbFyH4z:PKvFQAxOEk2fyvDIFwWS0Dis9ZkH4

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

faa2da00d5c848a1c95dfa411869c11e730afeb15b20ce16d8030f3a5acedaa0
.exe windows x86

cc76f329f185f49cd99c3ebd740bac3a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

DrawEdge
MessageBoxA

gdi32

CombineRgn

winmm

midiStreamClose

winspool.drv

DocumentPropertiesA

advapi32

RegCreateKeyExA

shell32

ShellExecuteA

ole32

OleInitialize

oleaut32

RegisterTypeLi

comctl32

ImageList_Destroy

ws2_32

WSAAsyncSelect

comdlg32

ChooseColorA

Sections

.text
Size: - Virtual size: 553KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cc76f329f185f49cd99c3ebd740bac3a

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

Sections

.text Size: - Virtual size: 553KB

.rdata Size: - Virtual size: 1.7MB

.data Size: - Virtual size: 121KB

.rsrc Size: 8KB - Virtual size: 22KB

.vmp0 Size: - Virtual size: 408KB

.vmp1 Size: 1.9MB - Virtual size: 1.9MB

.text
Size: - Virtual size: 553KB

.rdata
Size: - Virtual size: 1.7MB

.data
Size: - Virtual size: 121KB

.rsrc
Size: 8KB - Virtual size: 22KB

.vmp0
Size: - Virtual size: 408KB

.vmp1
Size: 1.9MB - Virtual size: 1.9MB