65b5fb4b01eb60f0a46747bade7397acebd802903f15c70a5bd29c9b73af8d82

Sharing

Copy URL Twitter E-mail

General

Target

65b5fb4b01eb60f0a46747bade7397acebd802903f15c70a5bd29c9b73af8d82
Size

72KB
MD5

ae45d3309dd08bd6d85753fe37870015
SHA1

f1df75655e577036db57d8cc3a57406c0de715c0
SHA256

65b5fb4b01eb60f0a46747bade7397acebd802903f15c70a5bd29c9b73af8d82
SHA512

d808e36ae33754db2e0c9566b1c34dc89027366ac06250988f84ee815210c128d74f39e332309b557d3178276ab9e1a6505f355c8c966838cd0ab886bd459a3b
SSDEEP

1536:/lfmsXT6mc8fZQrpwVdP7KzQiYViR97JZ:tfmk6mc8fOpwVt7/xAf

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

65b5fb4b01eb60f0a46747bade7397acebd802903f15c70a5bd29c9b73af8d82
.exe windows x86

c29fba230943ba747600a861dd453e22

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarTstGt
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
__vbaVarIndexLoadRef
_adj_fprem1
ord626
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaVarForInit
__vbaObjSet
__vbaOnError
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord520
__vbaVargVar
__vbaRefVarAry
_CIsin
ord632
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
ord561
__vbaObjVar
DllFunctionCall
__vbaRedimPreserve
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
__vbaR8ErrVar
ord608
ord716
__vbaFPException
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord644
__vbaExitEachVar
ord645
_CIlog
__vbaErrorOverflow
__vbaInStr
__vbaNew2
__vbaVarInt
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
__vbaVarCopy
__vbaVarLateMemCallLd
__vbaLateMemCallLd
ord617
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaForEachVar
_allmul
_CItan
ord546
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr

kernel32

GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c29fba230943ba747600a861dd453e22

Headers

File Characteristics

Imports

msvbvm60

kernel32

Sections

.text Size: - Virtual size: 32KB

.data Size: - Virtual size: 3KB

.vmp0 Size: - Virtual size: 20KB

.vmp1 Size: 60KB - Virtual size: 58KB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: - Virtual size: 32KB

.data
Size: - Virtual size: 3KB

.vmp0
Size: - Virtual size: 20KB

.vmp1
Size: 60KB - Virtual size: 58KB

.rsrc
Size: 8KB - Virtual size: 4KB