eb6a57f746bbf5d23c621e1884f164483f2bf4f2e946fdcfc1aefb440a2c009f

Sharing

Copy URL Twitter E-mail

General

Target

eb6a57f746bbf5d23c621e1884f164483f2bf4f2e946fdcfc1aefb440a2c009f
Size

1.3MB
MD5

24d94fc437e2b8c2d982db8b24c57fcf
SHA1

6c6b01e5898d239ec30a04b945cc5e815dd30a91
SHA256

eb6a57f746bbf5d23c621e1884f164483f2bf4f2e946fdcfc1aefb440a2c009f
SHA512

5f091dee3f31c804ddbc5ace99ce2639d677917b4f4fc13c83e3e0b598d26d624a680611d9a910bf5f2fb85ac37bd05deca8329288d911c54fc588b271faf873
SSDEEP

24576:LukZwiYp+EYpB3S+SajH6ALNkjIZ/T950Q9JihHbn047K7iuK/KMFm/bKbpkZ:LuiTYgB3lSam8zZTwQriWGCMFoKbpk

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

eb6a57f746bbf5d23c621e1884f164483f2bf4f2e946fdcfc1aefb440a2c009f
.exe windows x86

33c98c4ce2059a5ea7039726d21d0a6b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rasapi32

RasHangUpA

kernel32

lstrcmpiA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

MessageBoxA
MessageBoxA

gdi32

StretchBlt

winmm

waveOutUnprepareHeader

winspool.drv

ClosePrinter

advapi32

RegQueryValueA

shell32

ShellExecuteA

ole32

CreateILockBytesOnHGlobal

oleaut32

SafeArrayGetElemsize

comctl32

ord17

oledlg

ord8

ws2_32

WSAAsyncSelect

wininet

InternetOpenA

comdlg32

GetFileTitleA

Sections

.text
Size: - Virtual size: 503KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 907KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

33c98c4ce2059a5ea7039726d21d0a6b

Headers

File Characteristics

Imports

rasapi32

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

ws2_32

wininet

comdlg32

Sections

.text Size: - Virtual size: 503KB

.rdata Size: - Virtual size: 907KB

.data Size: - Virtual size: 199KB

.rsrc Size: 16KB - Virtual size: 28KB

.vmp0 Size: - Virtual size: 179KB

.vmp1 Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 4KB - Virtual size: 176B

.text
Size: - Virtual size: 503KB

.rdata
Size: - Virtual size: 907KB

.data
Size: - Virtual size: 199KB

.rsrc
Size: 16KB - Virtual size: 28KB

.vmp0
Size: - Virtual size: 179KB

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 4KB - Virtual size: 176B