00e04ac9c5637c6a7d4152ca566793fa07883c5695e16fb2b868d9a2a72bbff2

Sharing

Copy URL Twitter E-mail

General

Target

00e04ac9c5637c6a7d4152ca566793fa07883c5695e16fb2b868d9a2a72bbff2
Size

52KB
MD5

1f4fcf50702d591665cead1c584c2ab8
SHA1

babf018c46069d74fe5c4ff1e166cf894b17c78d
SHA256

00e04ac9c5637c6a7d4152ca566793fa07883c5695e16fb2b868d9a2a72bbff2
SHA512

2f90871e41eb8fcac93995d548b7432cea848b9a74a06159b4352c6618d1bba8f6024eb4d9664b4191026ccb1a033149ef8884656b92b37850e0cafa0e90f2dd
SSDEEP

1536:6cbZ7kd18MrjfMX5ft7BqKA2wmpMYAwjA:6IZ7kr8Mr4JfFI/2wm6nM

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

00e04ac9c5637c6a7d4152ca566793fa07883c5695e16fb2b868d9a2a72bbff2
.dll windows x86

84bedc70bf1d4af3462d8a952f908d41

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

PeekMessageA

advapi32

RegCloseKey

msvcrt

_adjust_fdiv

Exports

Exports

M
WahCloseApcHelper
WahCloseHandleHelper
WahCloseNotificationHandleHelper
WahCloseSocketHandle
WahCloseThread
WahCompleteRequest
WahCreateHandleContextTable
WahCreateNotificationHandle
WahCreateSocketHandle
WahDestroyHandleContextTable
WahDisableNonIFSHandleSupport
WahEnableNonIFSHandleSupport
WahEnumerateHandleContexts
WahInsertHandleContext
WahNotifyAllProcesses
WahOpenApcHelper
WahOpenCurrentThread
WahOpenHandleHelper
WahOpenNotificationHandleHelper
WahQueueUserApc
WahReferenceContextByHandle
WahRemoveHandleContext
WahWaitForNotification

Sections

.text
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

84bedc70bf1d4af3462d8a952f908d41

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

Exports

Exports

Sections

.text Size: - Virtual size: 7KB

.rdata Size: - Virtual size: 2KB

.data Size: - Virtual size: 23KB

.vmp0 Size: - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 8KB

.vmp1 Size: - Virtual size: 16KB

.vmp2 Size: 40KB - Virtual size: 38KB

.reloc Size: 4KB - Virtual size: 108B

.text
Size: - Virtual size: 7KB

.rdata
Size: - Virtual size: 2KB

.data
Size: - Virtual size: 23KB

.vmp0
Size: - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 8KB

.vmp1
Size: - Virtual size: 16KB

.vmp2
Size: 40KB - Virtual size: 38KB

.reloc
Size: 4KB - Virtual size: 108B