9c20d08ff4f828c99bc97b268619e266a4743aef9daa4a71b6ff849e7a10e364

Sharing

Copy URL Twitter E-mail

General

Target

9c20d08ff4f828c99bc97b268619e266a4743aef9daa4a71b6ff849e7a10e364
Size

38KB
MD5

b86399f299c6484d051b6a46e0ba03e0
SHA1

8908c41aaaccd7316e55d9778cebf3653c3aa832
SHA256

9c20d08ff4f828c99bc97b268619e266a4743aef9daa4a71b6ff849e7a10e364
SHA512

9f048ea30328f436fe05b171c0d729187c0e6be017b3e78708f8d6188fbf3933ea9f94f8a0c028ccc75c407f2a0b3a9870daded7a887f61d8fa9d1479fabe970
SSDEEP

768:1ly39kCj9NUGKtOIMbLYu0i/ghBZOrql89xHJNNPKO138j:g9kCjwftpAEu0iIZOOO9xHbNPKeMj

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

9c20d08ff4f828c99bc97b268619e266a4743aef9daa4a71b6ff849e7a10e364
.dll windows x86

5b36f205d48ab8961395279a3b5c0a0d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProfileStringA
GetModuleHandleA
CloseHandle
CreateThread
ExpandEnvironmentStringsW
VirtualProtect
GetTempPathW
GetTempPathA
GlobalFree
TerminateProcess
lstrcpyW
GetLastError
WideCharToMultiByte
GetModuleFileNameA
GetPrivateProfileStringA
lstrlenA
WritePrivateProfileStringA
WriteProfileStringA
VirtualAlloc
GetProcAddress
CreateFileA
lstrcatA
GetSystemDirectoryA
ReadFile
Sleep
LoadLibraryW
GlobalAlloc
VirtualFree
SetFilePointer
GetFileSize
lstrcpyA

user32

IsRectEmpty
wsprintfW
wsprintfA

gdi32

SelectObject
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
CreateDCA
DeleteDC
BitBlt

gdiplus

GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipGetImageEncoders
GdipSaveImageToFile
GdiplusStartup
GdiplusShutdown
GdipGetImageEncodersSize

ws2_32

recvfrom
setsockopt
gethostbyname
WSCGetProviderPath
htons
sendto
inet_addr
socket
WSAStartup
WSCEnumProtocols

msvcrt

memset
malloc
free
atoi
_wtol
memcpy
strstr

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle

shlwapi

PathRemoveFileSpecA

Exports

Exports

WSPStartup

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 676B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b36f205d48ab8961395279a3b5c0a0d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

gdiplus

ws2_32

msvcrt

wininet

shlwapi

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 3KB

.vmp0 Size: 1KB - Virtual size: 1KB

.vmp1 Size: 23KB - Virtual size: 23KB

.reloc Size: 1024B - Virtual size: 676B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 3KB

.vmp0
Size: 1KB - Virtual size: 1KB

.vmp1
Size: 23KB - Virtual size: 23KB

.reloc
Size: 1024B - Virtual size: 676B