a3b4ae5f4a4c45fdb14a47c7edad46eada7b46f832d999777a39123c02ae768d

Sharing

Copy URL Twitter E-mail

General

Target

a3b4ae5f4a4c45fdb14a47c7edad46eada7b46f832d999777a39123c02ae768d
Size

2.5MB
MD5

82762587331a024cd051adcef5c7b95d
SHA1

3a810d958e6c348cecdbd5ed9ca4f95407bea7e4
SHA256

a3b4ae5f4a4c45fdb14a47c7edad46eada7b46f832d999777a39123c02ae768d
SHA512

7884875cb30387c0b40e58fb4959c9a085d7ea24e00a8bb037a56a315f1abe191a84547292fec7e07d4992f76bcd58a3a5c6dbe23589e96473567ca2e80a8784
SSDEEP

49152:BBdV52nLRS2FTJq87h1VZnQ0JLhCEi4yCaYGAwMt3TrX4cqpOuWzGJqZLrz/YH5O:rdF2VJn1/lkE87pRI3/SpOuIGkZ/byQj

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

a3b4ae5f4a4c45fdb14a47c7edad46eada7b46f832d999777a39123c02ae768d
.dll windows x86

60209a194b51ad614cfc5ebc7243286f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess

user32

CreateMenu

gdi32

StretchBlt

winmm

waveOutUnprepareHeader

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueA

shell32

Shell_NotifyIconA

ole32

CLSIDFromString

oleaut32

LoadTypeLi

comctl32

ImageList_Destroy

ws2_32

recvfrom

comdlg32

GetOpenFileNameA

Exports

Exports

kjhkjhkjhkjmnbmn

Sections

.text
Size: - Virtual size: 505KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

60209a194b51ad614cfc5ebc7243286f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

Exports

Exports

Sections

.text Size: - Virtual size: 505KB

.rdata Size: - Virtual size: 89KB

.data Size: - Virtual size: 150KB

.rsrc Size: 8KB - Virtual size: 21KB

.vmp0 Size: - Virtual size: 67KB

.vmp1 Size: - Virtual size: 2.0MB

.tls Size: 4KB - Virtual size: 24B

.vmp2 Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 4KB - Virtual size: 148B

.text
Size: - Virtual size: 505KB

.rdata
Size: - Virtual size: 89KB

.data
Size: - Virtual size: 150KB

.rsrc
Size: 8KB - Virtual size: 21KB

.vmp0
Size: - Virtual size: 67KB

.vmp1
Size: - Virtual size: 2.0MB

.tls
Size: 4KB - Virtual size: 24B

.vmp2
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 4KB - Virtual size: 148B