c2df4f6b6f67df6bc735f7ab68bf4a307e5b5a642b18d16ef6a9f60ebd4443b8

General

Target

c2df4f6b6f67df6bc735f7ab68bf4a307e5b5a642b18d16ef6a9f60ebd4443b8
Size

56KB
MD5

fa475a178f2f6126c58a41b9afaef32e
SHA1

d7fe6311c3a61a08dec66d09b6f3d022d37520b7
SHA256

c2df4f6b6f67df6bc735f7ab68bf4a307e5b5a642b18d16ef6a9f60ebd4443b8
SHA512

d049ef6eccf0f8def14efbc0e9a9f6b5479661058879fe281b1e78c514980f8b7a7ac109840bf527c5674f70fd621e235dc873fb715b0ed684b13a9a136d8c2a
SSDEEP

1536:4fj4QXzj6S2L9f805yzwIddL15NZDydXgZh:Ukcpz04zwIbh5vyxI

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

c2df4f6b6f67df6bc735f7ab68bf4a307e5b5a642b18d16ef6a9f60ebd4443b8
.exe windows x86

464c7f35d5fd72f85368c1983eba0a84

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord537
ord800
ord926
ord924

msvcrt

__initenv
_cexit
_XcptFilter
_exit
_c_exit
__getmainargs
strlen
_controlfp
exit
strstr
rename
__CxxFrameHandler
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_except_handler3
strcat
strcpy
srand
rand
__set_app_type
memset
__p__fmode
_stricmp
_strlwr

kernel32

TerminateProcess
GetModuleFileNameA
CopyFileA
WinExec
CreateThread
GetCommandLineA
Sleep
FindClose
FindFirstFileA
GetModuleHandleA
CloseHandle
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
GetTickCount
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

PostMessageA
ShowWindow
IsWindow
FindWindowA
GetWindowThreadProcessId
SendMessageA
FindWindowExA
MessageBoxA

advapi32

RegOpenKeyA
RegQueryValueExA

psapi

EnumProcessModules
GetModuleFileNameExA
EnumProcesses

urlmon

URLDownloadToFileA

Sections

.text
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

464c7f35d5fd72f85368c1983eba0a84

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

psapi

urlmon

Sections

.text Size: - Virtual size: 8KB

.rdata Size: - Virtual size: 1KB

.data Size: - Virtual size: 932B

.vmp0 Size: - Virtual size: 16KB

.vmp1 Size: 52KB - Virtual size: 50KB

.text
Size: - Virtual size: 8KB

.rdata
Size: - Virtual size: 1KB

.data
Size: - Virtual size: 932B

.vmp0
Size: - Virtual size: 16KB

.vmp1
Size: 52KB - Virtual size: 50KB