cfa90f4b4d2e2aa6a727c5e0ed1b3156f4c2606e600afc6b1381a19e6b50cc5b

Sharing

Copy URL

Twitter E-mail

General

Target

cfa90f4b4d2e2aa6a727c5e0ed1b3156f4c2606e600afc6b1381a19e6b50cc5b
Size

4.8MB
MD5

0de7797d88bb20854239afd79ea037cb
SHA1

44098a67b9829ada566fd8c78e3886d51b4c9aa9
SHA256

cfa90f4b4d2e2aa6a727c5e0ed1b3156f4c2606e600afc6b1381a19e6b50cc5b
SHA512

026f600e0d4cb6576ecdfc02e233bdbd4ae7776d5babccbd9aa39254075f47460e007a5ad65c75a56e8addcf3bef520885651c945f14bf4bb110c85332be44f4
SSDEEP

6144:wMYXpkCzbH5STJ6222222222222222222222222222222222222222222222222Y:wFXpbsl3

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

cfa90f4b4d2e2aa6a727c5e0ed1b3156f4c2606e600afc6b1381a19e6b50cc5b
.exe windows x86

91909eaeeb54cb0af68fc43b339dacc8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord389
ord5207
ord5356
ord690
ord537
ord823
ord540
ord2614
ord860
ord825
ord5856
ord939
ord858
ord535
ord800

msvcrt

__dllonexit
_onexit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_CxxThrowException
srand
rand
fscanf
fopen
fclose
strrchr
malloc
_strlwr
strstr
_ftol
__CxxFrameHandler
time
localtime
strftime
_except_handler3
__setusermatherr
_itoa
_stricmp

kernel32

FindClose
GetProcAddress
LoadLibraryA
ExitProcess
GetLastError
CreateMutexA
CloseHandle
GetCurrentProcess
Sleep
CreateDirectoryA
GetWindowsDirectoryA
CreateFileA
VirtualFree
VirtualAlloc
WriteFile
GetModuleHandleA
CreateThread
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
SetFilePointer
ReadFile
WritePrivateProfileStringA
GetTempPathA
GetTempFileNameA
GetStartupInfoA
CreateProcessA
FindFirstFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

FindWindowA
OpenDesktopA
EnumDesktopWindows
GetWindowTextA
GetInputState
PostMessageA
wsprintfA
GetMessageA

shell32

ShellExecuteExA
SHGetSpecialFolderPathA

psapi

EnumProcessModules
GetModuleFileNameExA

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91909eaeeb54cb0af68fc43b339dacc8

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

shell32

psapi

Sections

.text Size: - Virtual size: 30KB

.rdata Size: - Virtual size: 3KB

.data Size: - Virtual size: 7KB

.vmp0 Size: - Virtual size: 11KB

.vmp1 Size: 81KB - Virtual size: 81KB

.rsrc Size: 1024B - Virtual size: 940B

.text
Size: - Virtual size: 30KB

.rdata
Size: - Virtual size: 3KB

.data
Size: - Virtual size: 7KB

.vmp0
Size: - Virtual size: 11KB

.vmp1
Size: 81KB - Virtual size: 81KB

.rsrc
Size: 1024B - Virtual size: 940B