99f8994b9bfcda7746e62137d2e40a10a46340d3e471b21a768103ee1fcfbbd1

Sharing

Copy URL Twitter E-mail

General

Target

99f8994b9bfcda7746e62137d2e40a10a46340d3e471b21a768103ee1fcfbbd1
Size

736KB
MD5

3e97c6bfc62704987d5cfe4a3fbc64d0
SHA1

948cb9b844cc5d20ef2462f8d36ad96649cc4fbb
SHA256

99f8994b9bfcda7746e62137d2e40a10a46340d3e471b21a768103ee1fcfbbd1
SHA512

e0e1b46d9ff028fd794287a7b3847a3fa749649a0146c2c76b3262eb51c01d2c174bb1242691a00505e0f3deaab07521dc2303bf028ee67f338d1a7e08e11c37
SSDEEP

12288:jVxsJ8NzN4YVo5qaWlWF/3a3iWO3MTkCBToO2/sSFHJl09VJuuqrRW4ERC6n:jVKJ8NzBhXMvayWOhCBUr/9pl0dFqrRI

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

99f8994b9bfcda7746e62137d2e40a10a46340d3e471b21a768103ee1fcfbbd1
.exe windows x86

4bd98c52817e06b25ee82b701ef72b15

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

midiStreamOut

ws2_32

WSAAsyncSelect

kernel32

MultiByteToWideChar
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

IsIconic
MessageBoxA

gdi32

GetTextMetricsA

winspool.drv

OpenPrinterA

advapi32

RegCloseKey

shell32

ShellExecuteA

ole32

CLSIDFromString

oleaut32

LoadTypeLi

comctl32

ord17

comdlg32

ChooseColorA

Sections

.text
Size: - Virtual size: 638KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 716KB - Virtual size: 712KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4bd98c52817e06b25ee82b701ef72b15

Headers

File Characteristics

Imports

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

Sections

.text Size: - Virtual size: 638KB

.rdata Size: - Virtual size: 228KB

.data Size: - Virtual size: 183KB

.rsrc Size: 12KB - Virtual size: 26KB

.vmp0 Size: - Virtual size: 155KB

.vmp1 Size: 716KB - Virtual size: 712KB

.reloc Size: 4KB - Virtual size: 108B

.text
Size: - Virtual size: 638KB

.rdata
Size: - Virtual size: 228KB

.data
Size: - Virtual size: 183KB

.rsrc
Size: 12KB - Virtual size: 26KB

.vmp0
Size: - Virtual size: 155KB

.vmp1
Size: 716KB - Virtual size: 712KB

.reloc
Size: 4KB - Virtual size: 108B