9d1b6047279d11946ae22dfb98ec5ae6abc5cf65c6f5d0da3fd83d11caa66c9b

Sharing

Copy URL Twitter E-mail

General

Target

9d1b6047279d11946ae22dfb98ec5ae6abc5cf65c6f5d0da3fd83d11caa66c9b
Size

46KB
MD5

9deb0ee26e5f44cc139c5d5df9ff0960
SHA1

0d4548240e0c3b75442e2c056e9c77227b57e36b
SHA256

9d1b6047279d11946ae22dfb98ec5ae6abc5cf65c6f5d0da3fd83d11caa66c9b
SHA512

85f6add8a7330023c743c5a37d97fe29c832fe1ac54ec033b6e927f372d49957051d0387cad18a0a4fe6382dc2434100822b2fc42433848f2181076c44c2cd4b
SSDEEP

768:abMKxJ43l2kVp/4pgJ5szz5x8gHza5bMw73TKF47:aHGElCIHwOtKWW

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

9d1b6047279d11946ae22dfb98ec5ae6abc5cf65c6f5d0da3fd83d11caa66c9b
.dll windows x86

fa71c0361c00ce423928bb450c80c0af

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
Beep
CreateThread
DisableThreadLibraryCalls
ExitProcess
FindAtomA
GetAtomNameA
GetModuleFileNameA
GetModuleHandleA
Sleep
VirtualProtect
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

msvcrt

__dllonexit
_errno
_iob
abort
fflush
fprintf
free
malloc
memmove
strstr

shell32

ShellExecuteA

user32

GetAsyncKeyState
MessageBeep
MessageBoxA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 304B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa71c0361c00ce423928bb450c80c0af

Headers

File Characteristics

Imports

kernel32

msvcrt

shell32

user32

Sections

.text Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 192B

.rdata Size: 1024B - Virtual size: 688B

.bss Size: - Virtual size: 304B

.idata Size: 1024B - Virtual size: 876B

.vmp0 Size: 8KB - Virtual size: 7KB

.vmp1 Size: 18KB - Virtual size: 18KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 192B

.rdata
Size: 1024B - Virtual size: 688B

.bss
Size: - Virtual size: 304B

.idata
Size: 1024B - Virtual size: 876B

.vmp0
Size: 8KB - Virtual size: 7KB

.vmp1
Size: 18KB - Virtual size: 18KB

.reloc
Size: 1KB - Virtual size: 1KB