bcc575d376733c4b4a76fe30ce287df76614f3b4cf5b6ac578be8f6484ec0f25

Sharing

Copy URL Twitter E-mail

General

Target

bcc575d376733c4b4a76fe30ce287df76614f3b4cf5b6ac578be8f6484ec0f25
Size

702KB
MD5

662819919fc99d02db404dcdc7b455e0
SHA1

1387d00bebf25c276e73f27dd40f3eb44ef81593
SHA256

bcc575d376733c4b4a76fe30ce287df76614f3b4cf5b6ac578be8f6484ec0f25
SHA512

dea3a0382fe864139020a5ba6155149a37bedde2ad16b986b8c245c0bf2d23c1817702a4b574787aee9e19b5c6c4ceb83a08a79fd02dd99c4a43d7115cc64cfa
SSDEEP

12288:092qICCRhUaCD0CmcRkHAYjRBpy8W6EmV3n1/y6czDBYhIDN++Mbz54szA2t1rdm:0JDCPg0CmczgfUNuaLvBYhaMbFzzgD

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

bcc575d376733c4b4a76fe30ce287df76614f3b4cf5b6ac578be8f6484ec0f25
.dll windows x86

cc57905849a5ff093518cfe8e2a0af53

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GlobalAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SetCursor
MessageBoxA

advapi32

RegCloseKey

oleaut32

SysAllocStringLen

version

GetFileVersionInfoSizeA

gdi32

SetBkColor

comctl32

ImageList_DrawEx

shell32

ShellExecuteA

Sections

CODE
Size: - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 7KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 696KB - Virtual size: 696KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cc57905849a5ff093518cfe8e2a0af53

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

comctl32

shell32

Sections

CODE Size: - Virtual size: 537KB

DATA Size: - Virtual size: 8KB

BSS Size: - Virtual size: 7KB

.idata Size: - Virtual size: 9KB

.vmp0 Size: - Virtual size: 41KB

.rsrc Size: 4KB - Virtual size: 45KB

.vmp1 Size: - Virtual size: 332KB

.vmp2 Size: 696KB - Virtual size: 696KB

.reloc Size: 512B - Virtual size: 244B

CODE
Size: - Virtual size: 537KB

DATA
Size: - Virtual size: 8KB

BSS
Size: - Virtual size: 7KB

.idata
Size: - Virtual size: 9KB

.vmp0
Size: - Virtual size: 41KB

.rsrc
Size: 4KB - Virtual size: 45KB

.vmp1
Size: - Virtual size: 332KB

.vmp2
Size: 696KB - Virtual size: 696KB

.reloc
Size: 512B - Virtual size: 244B