19083cf8e78428077714cc6b6d8ed4bb363cbeb646a5f9437e454ed533ebe718

Sharing

Copy URL

Twitter E-mail

General

Target

19083cf8e78428077714cc6b6d8ed4bb363cbeb646a5f9437e454ed533ebe718
Size

1.2MB
MD5

813d05905e8f7690614da3e6455d98f3
SHA1

a50fb2fa47191a51ba3ce374a1e30f4bc501a3e0
SHA256

19083cf8e78428077714cc6b6d8ed4bb363cbeb646a5f9437e454ed533ebe718
SHA512

728a1cf3c8e135a41e4b5d52123042bfaeb1844c4bb02ad37dea25d1961b2ab650e8f55f5872953b63ede847e66cfd8935dc6a8939c7e28c95cc82afca0ba7c5
SSDEEP

24576:lQYfjS4ZnUXeVv79kFRaxknOHStGlDtjNXHYYUhAz0s/cLN7jjrQTq9v:NLSInmel79yRoiOHSklDVNX4z0Qt/jx

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

19083cf8e78428077714cc6b6d8ed4bb363cbeb646a5f9437e454ed533ebe718
.exe windows x86

0f4add4c38076df87cca7689f71c1741

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

midiStreamOut

ws2_32

WSAAsyncSelect

kernel32

EnterCriticalSection
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

ShowWindow
MessageBoxA

gdi32

ExtSelectClipRgn

msimg32

GradientFill

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueExA

shell32

ShellExecuteA

ole32

CreateILockBytesOnHGlobal

oleaut32

VariantTimeToSystemTime

comctl32

ImageList_GetIcon

oledlg

ord8

comdlg32

GetOpenFileNameA

Sections

.text
Size: - Virtual size: 748KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 752KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f4add4c38076df87cca7689f71c1741

Headers

File Characteristics

Imports

winmm

ws2_32

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

comdlg32

Sections

.text Size: - Virtual size: 748KB

.rdata Size: - Virtual size: 752KB

.data Size: - Virtual size: 314KB

.rsrc Size: 24KB - Virtual size: 41KB

.vmp0 Size: - Virtual size: 176KB

.vmp1 Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 4KB - Virtual size: 148B

.text
Size: - Virtual size: 748KB

.rdata
Size: - Virtual size: 752KB

.data
Size: - Virtual size: 314KB

.rsrc
Size: 24KB - Virtual size: 41KB

.vmp0
Size: - Virtual size: 176KB

.vmp1
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 4KB - Virtual size: 148B