a5408650f1a64ca0e253bda228f9a8cee3d8cd175deddcaeb814718b353afd9b

Sharing

Copy URL Twitter E-mail

General

Target

a5408650f1a64ca0e253bda228f9a8cee3d8cd175deddcaeb814718b353afd9b
Size

2.7MB
MD5

083e9bdddb659031779f723f87d13aa9
SHA1

d2df725190109d178fef262ca4ad3fac77c57160
SHA256

a5408650f1a64ca0e253bda228f9a8cee3d8cd175deddcaeb814718b353afd9b
SHA512

089f8f782aabbbc2505a5e1cd1e30c7a98cb79622b0b95151840ade75ded4f931db0ac40902a74e570b81e98d8914a5ad726571416ab5c01007645f8fe794470
SSDEEP

12288:borGoNkqwzYYYYYYYYYYYYYYYYYYYYYYYYYYYu:biHW

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

a5408650f1a64ca0e253bda228f9a8cee3d8cd175deddcaeb814718b353afd9b
.exe windows x86

91909eaeeb54cb0af68fc43b339dacc8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord389
ord5207
ord5356
ord690
ord537
ord823
ord540
ord2614
ord860
ord825
ord5856
ord939
ord858
ord535
ord800

msvcrt

__dllonexit
_onexit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_CxxThrowException
srand
rand
fscanf
fopen
fclose
strrchr
malloc
_strlwr
strstr
_ftol
__CxxFrameHandler
time
localtime
strftime
_except_handler3
__setusermatherr
_itoa
_stricmp

kernel32

FindClose
GetProcAddress
LoadLibraryA
ExitProcess
GetLastError
CreateMutexA
CloseHandle
GetCurrentProcess
Sleep
CreateDirectoryA
GetWindowsDirectoryA
CreateFileA
VirtualFree
VirtualAlloc
WriteFile
GetModuleHandleA
CreateThread
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
SetFilePointer
ReadFile
WritePrivateProfileStringA
GetTempPathA
GetTempFileNameA
GetStartupInfoA
CreateProcessA
FindFirstFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

FindWindowA
OpenDesktopA
EnumDesktopWindows
GetWindowTextA
GetInputState
PostMessageA
wsprintfA
GetMessageA

shell32

ShellExecuteExA
SHGetSpecialFolderPathA

psapi

EnumProcessModules
GetModuleFileNameExA

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91909eaeeb54cb0af68fc43b339dacc8

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

shell32

psapi

Sections

.text Size: - Virtual size: 30KB

.rdata Size: - Virtual size: 3KB

.data Size: - Virtual size: 7KB

.vmp0 Size: - Virtual size: 10KB

.vmp1 Size: 78KB - Virtual size: 78KB

.rsrc Size: 1024B - Virtual size: 940B

.text
Size: - Virtual size: 30KB

.rdata
Size: - Virtual size: 3KB

.data
Size: - Virtual size: 7KB

.vmp0
Size: - Virtual size: 10KB

.vmp1
Size: 78KB - Virtual size: 78KB

.rsrc
Size: 1024B - Virtual size: 940B