93c64fba95493749eddc5274f7535debae182f9caa3b169c33d85d8be3ff45c8

Sharing

Copy URL Twitter E-mail

General

Target

93c64fba95493749eddc5274f7535debae182f9caa3b169c33d85d8be3ff45c8
Size

1.4MB
MD5

e2d9fb402d51714891684c3b59f52329
SHA1

940f937773edfd6ed5517f3b066d398f08222fd1
SHA256

93c64fba95493749eddc5274f7535debae182f9caa3b169c33d85d8be3ff45c8
SHA512

8b9855c850ad8c10df239389b07490e4c93024d17ac08522d1e25034b0ee4bcd17e7dba869dd8bcd0f16cb97e8c2bb454d75a68fd5c95222dcceb1666ecd9536
SSDEEP

24576:EVPbyFFxXeqO8ucx3P71WEZDBd+1aKGQ25OHbRgzgx5xwwrgBvCkciDiBuH6W54R:Y2FFDOGrDBd+1A0HbO0jyHZ9ciDiBu3Y

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

93c64fba95493749eddc5274f7535debae182f9caa3b169c33d85d8be3ff45c8
.dll windows x86

2277f8033e3ebb4facc6458d8aedcc7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

midiStreamClose

ws2_32

WSACleanup

kernel32

SetErrorMode
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess

user32

GetSysColor

gdi32

GetObjectA

winspool.drv

ClosePrinter

advapi32

RegCloseKey

shell32

ShellExecuteA

ole32

OleUninitialize

oleaut32

UnRegisterTypeLi

comctl32

ord17

comdlg32

ChooseColorA

Exports

Exports

DMOGetName

Sections

.text
Size: - Virtual size: 585KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 961KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2277f8033e3ebb4facc6458d8aedcc7b

Headers

File Characteristics

Imports

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

Exports

Exports

Sections

.text Size: - Virtual size: 585KB

.rdata Size: - Virtual size: 131KB

.data Size: - Virtual size: 263KB

.rsrc Size: 12KB - Virtual size: 23KB

.vmp0 Size: - Virtual size: 81KB

.vmp1 Size: - Virtual size: 961KB

.tls Size: 4KB - Virtual size: 24B

.vmp2 Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 4KB - Virtual size: 272B

.text
Size: - Virtual size: 585KB

.rdata
Size: - Virtual size: 131KB

.data
Size: - Virtual size: 263KB

.rsrc
Size: 12KB - Virtual size: 23KB

.vmp0
Size: - Virtual size: 81KB

.vmp1
Size: - Virtual size: 961KB

.tls
Size: 4KB - Virtual size: 24B

.vmp2
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 4KB - Virtual size: 272B