091f6879c41bf813b11b8c1fc773cc9f58b291f8887d93500009ddfa222e6a0b

Sharing

Copy URL Twitter E-mail

General

Target

091f6879c41bf813b11b8c1fc773cc9f58b291f8887d93500009ddfa222e6a0b
Size

1.3MB
MD5

1cb4e14973a5515b4e213fa454b81dc8
SHA1

e6630d5a37d4bc13d56e1f7bfe2fb8e0f045654a
SHA256

091f6879c41bf813b11b8c1fc773cc9f58b291f8887d93500009ddfa222e6a0b
SHA512

f663d73ad97ad28f43abd71b169d3828d28e5f6d8545ccc259d0d7121e383a903fe642678748da43b3366f33b4870f0436a93cd004f0c2269f1c6bab4ede5229
SSDEEP

24576:tyzWlDkF8i48Rnhha/mBHCe8jnjwqDdaZy51Wt6Kavbym04uMZFQ5fNK:kzWlDkF348RnhVF8zsYaZy26o0Zi

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

091f6879c41bf813b11b8c1fc773cc9f58b291f8887d93500009ddfa222e6a0b
.exe windows x86

4d7a37df2191d032c838f103f44f16d1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

PostMessageA

gdi32

GetDeviceCaps

winmm

midiOutReset

winspool.drv

OpenPrinterA

advapi32

RegCreateKeyExA

shell32

Shell_NotifyIconA

ole32

CoGetClassObject

oleaut32

SafeArrayGetElement

comctl32

ord17

oledlg

ord8

ws2_32

recvfrom

comdlg32

GetSaveFileNameA

Sections

.text
Size: - Virtual size: 699KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 837KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4d7a37df2191d032c838f103f44f16d1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

ws2_32

comdlg32

Sections

.text Size: - Virtual size: 699KB

.rdata Size: - Virtual size: 200KB

.data Size: - Virtual size: 173KB

.vmp0 Size: - Virtual size: 837KB

.vmp1 Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 44KB - Virtual size: 42KB

.text
Size: - Virtual size: 699KB

.rdata
Size: - Virtual size: 200KB

.data
Size: - Virtual size: 173KB

.vmp0
Size: - Virtual size: 837KB

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 44KB - Virtual size: 42KB