e785e87f0e16a7b52ec8a725dcb048e6310532c9c535dfef70b0d969a4dd85ab

Sharing

Copy URL Twitter E-mail

General

Target
e785e87f0e16a7b52ec8a725dcb048e6310532c9c535dfef70b0d969a4dd85ab
Size 6.1MB
Sample221204-19rlqabc66
SHA256 e785e87f0e16a7b52ec8a725dcb048e6310532c9c535dfef70b0d969a4dd85ab
MD5 48978e12606c69a14525441154e7bfd5
SHA1 7402deebde1bb439be4c938458f9139ff8ba16ce
SHA512 08f7389f19c51b0070c87a129068867cdb1ea24d768ed29001796290182fa1fcb9a3a9a1fc1cd22c49ff251e0366f5dd380ddac7c64e08a2851f8cea287fe9f1
SSDEEP 98304:dSPwB+aOipCWBR6K4OIiGMprhRp8kBdQ9UEUvQxXf1tpqinVruk:vB+aOiDUKzDrhQLZK0f1tQpk
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

e785e87f0e16a7b52ec8a725dcb048e6310532c9c535dfef70b0d969a4dd85ab

.exe 6.1MB

e785e87f0e16a7b52ec8a725dcb048e6310532c9c535dfef70b0d969a4dd85ab

IMPHASH 5780e08c9c78220a0c99027a41bbbfa4
SHA256 e785e87f0e16a7b52ec8a725dcb048e6310532c9c535dfef70b0d969a4dd85ab
MD5 48978e12606c69a14525441154e7bfd5
SHA1 7402deebde1bb439be4c938458f9139ff8ba16ce
SHA512 08f7389f19c51b0070c87a129068867cdb1ea24d768ed29001796290182fa1fcb9a3a9a1fc1cd22c49ff251e0366f5dd380ddac7c64e08a2851f8cea287fe9f1
SSDEEP 98304:dSPwB+aOipCWBR6K4OIiGMprhRp8kBdQ9UEUvQxXf1tpqinVruk:vB+aOiDUKzDrhQLZK0f1tQpk
MD5 SHA1 SHA512 SSDEEP

windows x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Minor OS version

Major OS version

Entry point

12366813

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

WriteFile WriteConsoleW WaitForMultipleObjects WaitForSingleObject VirtualQuery VirtualFree VirtualAlloc SwitchToThread SuspendThread SetWaitableTimer SetUnhandledExceptionFilter SetProcessPriorityBoost SetEvent SetErrorMode SetConsoleCtrlHandler ResumeThread PostQueuedCompletionStatus LoadLibraryA LoadLibraryW SetThreadContext GetThreadContext GetSystemInfo GetSystemDirectoryA GetStdHandle GetQueuedCompletionStatusEx GetProcessAffinityMask GetProcAddress GetEnvironmentStringsW GetConsoleMode FreeEnvironmentStringsW ExitProcess DuplicateHandle CreateWaitableTimerExW CreateThread CreateIoCompletionPort CreateFileA CreateEventA CloseHandle AddVectoredExceptionHandler GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers WriteConsoleW SetStdHandle IsProcessorFeaturePresent DecodePointer GetCommandLineA RaiseException HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringW GetStringTypeW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc VirtualQuery LocalAlloc LocalFree GetModuleFileNameW ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

CharUpperBuffW

Name

.text

Size

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

988B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.symtab

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ

Name

.vmp1

Size

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp2

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp3

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

181KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ