7117acf3ff65d4f3317e4fbe93e260991159ce95d53ecb6c81405e8d93c86512

Sharing

Copy URL Twitter E-mail

General

Target

7117acf3ff65d4f3317e4fbe93e260991159ce95d53ecb6c81405e8d93c86512
Size

880KB
MD5

aff30ee529f6ea454c93c72a91555d45
SHA1

772d12e2183a747072de86b657c31ffa9ff11691
SHA256

7117acf3ff65d4f3317e4fbe93e260991159ce95d53ecb6c81405e8d93c86512
SHA512

e152564b3da199d7588af8f8f999eef4c699d9058fa0d143064628eacfd2ede8a27cc1c583a416e5e6b981b87ed9ba4cfc77fbe009b324243dc92760a6628d67
SSDEEP

24576:z+xl5BQLEDXFjVmDZ8xXEk29dOQC4OZHkf:4DaoLFj4DZi0RdFCpHk

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

7117acf3ff65d4f3317e4fbe93e260991159ce95d53ecb6c81405e8d93c86512
.exe windows x86

fd6deafd7d119757a6d5bcd358e7b78f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

midiStreamOut

ws2_32

closesocket

rasapi32

RasGetConnectStatusA

kernel32

MultiByteToWideChar
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

GetWindow
MessageBoxA

gdi32

TextOutA

winspool.drv

DocumentPropertiesA

advapi32

RegOpenKeyExA

shell32

Shell_NotifyIconA

ole32

CLSIDFromProgID

oleaut32

VariantChangeType

comctl32

ImageList_GetIcon

wininet

InternetCloseHandle

comdlg32

ChooseColorA

Sections

.text
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 864KB - Virtual size: 862KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd6deafd7d119757a6d5bcd358e7b78f

Headers

File Characteristics

Imports

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wininet

comdlg32

Sections

.text Size: - Virtual size: 1.0MB

.rdata Size: - Virtual size: 417KB

.data Size: - Virtual size: 321KB

.rsrc Size: 8KB - Virtual size: 19KB

.vmp0 Size: - Virtual size: 148KB

.vmp1 Size: 864KB - Virtual size: 862KB

.reloc Size: 4KB - Virtual size: 68B

.text
Size: - Virtual size: 1.0MB

.rdata
Size: - Virtual size: 417KB

.data
Size: - Virtual size: 321KB

.rsrc
Size: 8KB - Virtual size: 19KB

.vmp0
Size: - Virtual size: 148KB

.vmp1
Size: 864KB - Virtual size: 862KB

.reloc
Size: 4KB - Virtual size: 68B