d682cae2b32a5d441a3aeaca6d0fab0c0d1d57016432941c20a54c61227b600c

Sharing

Copy URL Twitter E-mail

General

Target

d682cae2b32a5d441a3aeaca6d0fab0c0d1d57016432941c20a54c61227b600c
Size

1.3MB
MD5

6762e3051b1b42ee82e8559fd67c6b19
SHA1

8a374adc9e22089d83a674ad9c2a7a7d8eff991f
SHA256

d682cae2b32a5d441a3aeaca6d0fab0c0d1d57016432941c20a54c61227b600c
SHA512

756e9a23940863a53b3fcaaff16ade0c9262cfc2eb5ee77d9210d8f918f1886f132a30776e05bbbe09a41ce5f1b8bff54a0d83effecc78691108dce45854a0e2
SSDEEP

24576:uKO2aSdwAhKUmDGTuDRyDxwkFZICBtkxp/nEzJp1nZBcnz7eyUjv5xH4MDHh5oih:uedHRmGT0AvnfBWpsf1TcnHQN4MDHwi

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

d682cae2b32a5d441a3aeaca6d0fab0c0d1d57016432941c20a54c61227b600c
.exe windows x86

4108466851d273ee594a25949164b3a0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEndOfFile
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

OpenClipboard
MessageBoxA

gdi32

SetStretchBltMode

winmm

midiStreamRestart

winspool.drv

ClosePrinter

advapi32

RegCloseKey

shell32

ShellExecuteA

ole32

OleUninitialize

oleaut32

UnRegisterTypeLi

comctl32

ImageList_Destroy

ws2_32

recv

comdlg32

GetFileTitleA

Sections

.text
Size: - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 865KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4108466851d273ee594a25949164b3a0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

Sections

.text Size: - Virtual size: 413KB

.rdata Size: - Virtual size: 865KB

.data Size: - Virtual size: 121KB

.rsrc Size: 28KB - Virtual size: 38KB

.vmp0 Size: - Virtual size: 155KB

.vmp1 Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 4KB - Virtual size: 128B

.text
Size: - Virtual size: 413KB

.rdata
Size: - Virtual size: 865KB

.data
Size: - Virtual size: 121KB

.rsrc
Size: 28KB - Virtual size: 38KB

.vmp0
Size: - Virtual size: 155KB

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 4KB - Virtual size: 128B