9ef59fc3e41e21acd36fd8403a33aca6c31a7d0ba5818a080cca91fd411fb9b2

General

Target

9ef59fc3e41e21acd36fd8403a33aca6c31a7d0ba5818a080cca91fd411fb9b2
Size

248KB
MD5

110bed696932cb064d2398fabedd8572
SHA1

c319563d18475ee725d004e1a9c8e337a8ae13e4
SHA256

9ef59fc3e41e21acd36fd8403a33aca6c31a7d0ba5818a080cca91fd411fb9b2
SHA512

f8892ef08c33bcf831a203fbd2293ecc608dfe54052e2f7ed09e1fef4c2025466e925c2abd0d16de2eef02e465759eee4d73b4bb94cbd30af468c368564876c6
SSDEEP

6144:dMhDmp1I1D9kV9m1xyuENmV0fttm4C5NmPE/:Khc1I12HmqjN3ttm43s

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

9ef59fc3e41e21acd36fd8403a33aca6c31a7d0ba5818a080cca91fd411fb9b2
.exe windows x86

e150f65628ae75dfb471e2598528c2a1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetCurrentThreadId
SetUnhandledExceptionFilter
ExpandEnvironmentStringsA
SetLastError
lstrcmpiA
lstrlenA
lstrcpyA
FindResourceA
LoadResource
LockResource
ExitProcess
lstrcatA
LoadLibraryA
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
VirtualProtect
GetModuleFileNameA
ExitProcess

advapi32

RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegCloseKey
OpenSCManagerA
CreateServiceA
RegCreateKeyExA
RegSetValueExA

msvcrt

??1type_info@@UAE@XZ
_controlfp
_except_handler3
strchr
fclose
fwrite
fopen
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
strstr
??3@YAXPAX@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type

user32

PostThreadMessageA
GetInputState
wsprintfA
GetMessageA
MessageBoxA

Sections

.text
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 540KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e150f65628ae75dfb471e2598528c2a1

Headers

File Characteristics

Imports

kernel32

advapi32

msvcrt

user32

Sections

.text Size: - Virtual size: 6KB

.rsrc Size: 28KB - Virtual size: 540KB

.vmp0 Size: - Virtual size: 11KB

.vmp1 Size: 218KB - Virtual size: 217KB

.reloc Size: 512B - Virtual size: 56B

.text
Size: - Virtual size: 6KB

.rsrc
Size: 28KB - Virtual size: 540KB

.vmp0
Size: - Virtual size: 11KB

.vmp1
Size: 218KB - Virtual size: 217KB

.reloc
Size: 512B - Virtual size: 56B