f6419c031704a5f863a689081ad99c3fd07dcaa907e5474054a32b4c4ca1b8ed

Sharing

Copy URL Twitter E-mail

General

Target

f6419c031704a5f863a689081ad99c3fd07dcaa907e5474054a32b4c4ca1b8ed
Size

396KB
MD5

af95333a4f34890aa62d1f247bd076e0
SHA1

ea7a4bc6ba6a15ab2326db225eac0621aa18e1db
SHA256

f6419c031704a5f863a689081ad99c3fd07dcaa907e5474054a32b4c4ca1b8ed
SHA512

0eb2bfb381b41e8e90b75428105b9527fd9d2c396c727106d065f6222ba04d6f68646e84a14d8047a063c57f5fd3d82470cabd8983c54dccab3d17898693bf8f
SSDEEP

6144:aExKucH+fOkEXRTrC6kpitmdD019YRwwhaXx2i7SFf:qucH+fOkEXRTrC6/mdD0oRDoHI

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

f6419c031704a5f863a689081ad99c3fd07dcaa907e5474054a32b4c4ca1b8ed
.exe windows x86

76d9d0658def6ac1c4f060dc6f2fd8a4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
ResumeThread
SetThreadContext
WriteProcessMemory
lstrcmpiA
GetModuleFileNameA
ReadProcessMemory
GetThreadContext
CreateProcessA
ExitProcess
CloseHandle
GetCurrentProcess
WideCharToMultiByte
MultiByteToWideChar
OutputDebugStringA
DeleteFileA
MoveFileA
FreeResource
lstrlenA
WriteFile
SetFileTime
LocalFileTimeToFileTime
FindFirstFileA
lstrcatA
CreateFileA
LoadResource
FindResourceA
GetTickCount
GetTempPathA
lstrcpyA
SetLastError
GetLastError
ReadFile
SetFilePointer
GetPrivateProfileStringA
WritePrivateProfileStringA
CreateDirectoryA
GetFileAttributesA
SetUnhandledExceptionFilter
Sleep
ReleaseMutex
CreateMutexA
GetCommandLineA
GetCurrentThreadId
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
ExitProcess

msvcrt

_except_handler3
strchr
??3@YAXPAX@Z
??2@YAPAXI@Z
rand
strstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
memset
memcpy
strlen
malloc
realloc
_CxxThrowException
__CxxFrameHandler
_strcmpi

ntdll

ZwUnmapViewOfSection

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 286KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

yuxuan
Size: - Virtual size: 188B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

76d9d0658def6ac1c4f060dc6f2fd8a4

Headers

File Characteristics

Imports

kernel32

msvcrt

ntdll

user32

Sections

.text Size: - Virtual size: 13KB

.rsrc Size: 286KB - Virtual size: 424KB

yuxuan Size: - Virtual size: 188B

.vmp0 Size: - Virtual size: 8KB

.vmp1 Size: 109KB - Virtual size: 108KB

.reloc Size: 512B - Virtual size: 52B

.text
Size: - Virtual size: 13KB

.rsrc
Size: 286KB - Virtual size: 424KB

yuxuan
Size: - Virtual size: 188B

.vmp0
Size: - Virtual size: 8KB

.vmp1
Size: 109KB - Virtual size: 108KB

.reloc
Size: 512B - Virtual size: 52B