c3cc791162217675482ff43e63bdced052f523e7c3d035cc3b6dcd7984a98976

Sharing

Copy URL

Twitter E-mail

General

Target

c3cc791162217675482ff43e63bdced052f523e7c3d035cc3b6dcd7984a98976
Size

220KB
MD5

df0356d8758a420283ed285040c2ed37
SHA1

476f12c1ed91a7c3d67e132b77dcfb530533f56c
SHA256

c3cc791162217675482ff43e63bdced052f523e7c3d035cc3b6dcd7984a98976
SHA512

2fdf9380ad2509f5b0d2b1a932552459974a91cc4c5ed864a7db995ca418273637c426254ccd43d441a60b62fefd7e991ebe38e00978a1d9bee64f76af3da206
SSDEEP

6144:sZVxRCUCU0oetYjVV27mZOHePuT6E3we7JHUQINF:WrCVNYjVV27RQuT6E31a

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

c3cc791162217675482ff43e63bdced052f523e7c3d035cc3b6dcd7984a98976
.dll windows x86

2f788df714a8e73177e4fd17d68eb784

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

winmm

timeGetTime

Exports

Exports

??0CRotatorBase@@QAE@XZ
??4CRotatorBase@@QAEAAV0@ABV0@@Z
rotatorCheckSpell
rotatorDoLua
rotatorGetSystemTime
rotatorGetText
rotatorInitialize
rotatorInstallEnv
rotatorInstallFunc
rotatorLastSpell
rotatorLeftClick
rotatorPreInstall

Sections

.fcode
Size: - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 212KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f788df714a8e73177e4fd17d68eb784

Headers

File Characteristics

Imports

kernel32

winmm

Exports

Exports

Sections

.fcode Size: - Virtual size: 69KB

.text Size: - Virtual size: 50KB

.rdata Size: - Virtual size: 6KB

.data Size: - Virtual size: 19KB

.fdata Size: - Virtual size: 5KB

.vmp0 Size: - Virtual size: 12KB

.vmp1 Size: - Virtual size: 105KB

.vmp2 Size: 212KB - Virtual size: 210KB

.reloc Size: 4KB - Virtual size: 216B

.fcode
Size: - Virtual size: 69KB

.text
Size: - Virtual size: 50KB

.rdata
Size: - Virtual size: 6KB

.data
Size: - Virtual size: 19KB

.fdata
Size: - Virtual size: 5KB

.vmp0
Size: - Virtual size: 12KB

.vmp1
Size: - Virtual size: 105KB

.vmp2
Size: 212KB - Virtual size: 210KB

.reloc
Size: 4KB - Virtual size: 216B