6284d5234872c318499ebc05a9c979e30f62d02e4d96a14d9d51a4446e55a20b

Sharing

Copy URL Twitter E-mail

General

Target

6284d5234872c318499ebc05a9c979e30f62d02e4d96a14d9d51a4446e55a20b
Size

1.7MB
MD5

36bfd7daafac6f13241694f4bd065ca8
SHA1

6cbd9cca2ba5da0014fbd59547151ac32c57720d
SHA256

6284d5234872c318499ebc05a9c979e30f62d02e4d96a14d9d51a4446e55a20b
SHA512

b4d010dd24b6437b9eed0c4b54b96a2c424e943ede38ed8f99eef8f7154f89767d9874a41c62ad94874dacac475fd6a1a394c5df725277053ca2197e7ec3dd14
SSDEEP

49152:eA5eO+bSfgd7E7ryBtDK5u7fuIP7jGXTAADtR1CYTLfEI+vgRX:eAYOVo9tDKA7fuQnApGIAIH

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

6284d5234872c318499ebc05a9c979e30f62d02e4d96a14d9d51a4446e55a20b
.exe windows x86

6069b65828dbe97e48c4c951c0317e19

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rasapi32

RasGetConnectStatusA

kernel32

IsBadReadPtr
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetMenu

gdi32

BitBlt

winmm

midiStreamOut

winspool.drv

DocumentPropertiesA

advapi32

RegQueryValueExA

shell32

Shell_NotifyIconA

ole32

OleUninitialize

oleaut32

UnRegisterTypeLi

comctl32

ImageList_Destroy

ws2_32

inet_ntoa

wininet

InternetOpenA

comdlg32

GetSaveFileNameA

Sections

.text
Size: - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 833KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6069b65828dbe97e48c4c951c0317e19

Headers

File Characteristics

Imports

rasapi32

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

wininet

comdlg32

Sections

.text Size: - Virtual size: 487KB

.rdata Size: - Virtual size: 1.4MB

.data Size: - Virtual size: 206KB

.vmp0 Size: - Virtual size: 833KB

.vmp1 Size: 1.7MB - Virtual size: 1.7MB

.rsrc Size: 24KB - Virtual size: 36KB

.text
Size: - Virtual size: 487KB

.rdata
Size: - Virtual size: 1.4MB

.data
Size: - Virtual size: 206KB

.vmp0
Size: - Virtual size: 833KB

.vmp1
Size: 1.7MB - Virtual size: 1.7MB

.rsrc
Size: 24KB - Virtual size: 36KB