cdc7e1b24e8d48f1d854aa8903e99b9b2faa2627c6a0f654a5765ff279b7c67e

Sharing

Copy URL

Twitter E-mail

General

Target

cdc7e1b24e8d48f1d854aa8903e99b9b2faa2627c6a0f654a5765ff279b7c67e
Size

3.2MB
MD5

cbdd26da65a63f6218f141280eda7f8d
SHA1

d9a26411630d98433d1c55b371d4aa3501b6924f
SHA256

cdc7e1b24e8d48f1d854aa8903e99b9b2faa2627c6a0f654a5765ff279b7c67e
SHA512

5a0e1f072ed70eda1674a7d00e5d332d2de4ea41257340b451634cdff1e9299a062df028ab2a2904704b97a32c6c96ba087b155a6168a4933a7d6e30d79d0d79
SSDEEP

49152:BVtUeI7fKfOyPsqGotq68u5Ie1UDAG9gi84aUVbG/f+yk2QikwYWGsURsA1T:JdKQNxEFDN9t8BUVK/fzH13UR3

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

cdc7e1b24e8d48f1d854aa8903e99b9b2faa2627c6a0f654a5765ff279b7c67e
.exe windows x86

c7151c8efd4341979ff71bae8096098e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeEnvironmentStringsA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

GetForegroundWindow
MessageBoxA

gdi32

GetTextMetricsA

winmm

midiOutReset

winspool.drv

ClosePrinter

advapi32

RegOpenKeyExA

shell32

ShellExecuteA

ole32

CLSIDFromProgID

oleaut32

VariantClear

comctl32

ImageList_Destroy

ws2_32

inet_ntoa

comdlg32

GetFileTitleA

Sections

.text
Size: - Virtual size: 450KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7151c8efd4341979ff71bae8096098e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

Sections

.text Size: - Virtual size: 450KB

.rdata Size: - Virtual size: 2.6MB

.data Size: - Virtual size: 157KB

.rsrc Size: 12KB - Virtual size: 23KB

.vmp0 Size: - Virtual size: 155KB

.vmp1 Size: 3.2MB - Virtual size: 3.2MB

.reloc Size: 4KB - Virtual size: 256B

.text
Size: - Virtual size: 450KB

.rdata
Size: - Virtual size: 2.6MB

.data
Size: - Virtual size: 157KB

.rsrc
Size: 12KB - Virtual size: 23KB

.vmp0
Size: - Virtual size: 155KB

.vmp1
Size: 3.2MB - Virtual size: 3.2MB

.reloc
Size: 4KB - Virtual size: 256B