901e632f2aa3d2c3f0f8becfc2f9d7f64aba49f2045e0066a2f72cb49273166c

Sharing

Copy URL Twitter E-mail

General

Target

901e632f2aa3d2c3f0f8becfc2f9d7f64aba49f2045e0066a2f72cb49273166c
Size

1.9MB
MD5

f7f15042e6ea3ba2b6f582fdbbe53c6a
SHA1

28d2e448c546f273b383acf407506eee8d7e405b
SHA256

901e632f2aa3d2c3f0f8becfc2f9d7f64aba49f2045e0066a2f72cb49273166c
SHA512

bb429cd8905eeb1fe120f88f7013cffe2954d0920f0758de4e62cfdaf998e65a3e455c3c040e5624097d5c46d60882fd9ab2b0d765d194e6f26a30e308fbab3c
SSDEEP

49152:su9lc9bmuRqbw76kH01t/wLERqHcBMrFq0yBCZT:FlcxRcBkyt/AERqHCMrs0GCh

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

901e632f2aa3d2c3f0f8becfc2f9d7f64aba49f2045e0066a2f72cb49273166c
.exe windows x86

05ff593fa9d0fb389375e714dd8c5e80

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReleaseSemaphore
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess

user32

SetActiveWindow

gdi32

CreateBitmap

winmm

midiStreamOut

winspool.drv

DocumentPropertiesA

advapi32

RegOpenKeyExA

shell32

Shell_NotifyIconA

ole32

OleUninitialize

oleaut32

LoadTypeLi

comctl32

ord17

ws2_32

inet_ntoa

comdlg32

GetOpenFileNameA

Sections

.text
Size: - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 296KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.9MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

05ff593fa9d0fb389375e714dd8c5e80

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

Sections

.text Size: - Virtual size: 451KB

.rdata Size: - Virtual size: 1.4MB

.data Size: - Virtual size: 205KB

.rsrc Size: 8KB - Virtual size: 22KB

.vmp0 Size: - Virtual size: 296KB

.tls Size: 4KB - Virtual size: 24B

.vmp1 Size: 1.9MB - Virtual size: 1.8MB

.text
Size: - Virtual size: 451KB

.rdata
Size: - Virtual size: 1.4MB

.data
Size: - Virtual size: 205KB

.rsrc
Size: 8KB - Virtual size: 22KB

.vmp0
Size: - Virtual size: 296KB

.tls
Size: 4KB - Virtual size: 24B

.vmp1
Size: 1.9MB - Virtual size: 1.8MB