a20f20fa2352a77b6d4c69fa3314d3f14b97a7e1603144d54cc70fc83e18afa8

General

Target

a20f20fa2352a77b6d4c69fa3314d3f14b97a7e1603144d54cc70fc83e18afa8
Size

57KB
MD5

e1b59e86aacaa1a71d6b0a538cbaa948
SHA1

8f57a5b774fb1e3c411e5a52be66c3fd9b8379cb
SHA256

a20f20fa2352a77b6d4c69fa3314d3f14b97a7e1603144d54cc70fc83e18afa8
SHA512

6a2913b288638d9aa912ba68ab21e283a9b9c0ee1c376861229f4e5e7d5c82fa2b4f46a7e9054c789e963fa77051d6d97bea781eef241050234bfcef47015d2a
SSDEEP

1536:tDtxUkjvtJ2zViYfAr7UWzMD3l0OllvtUoCCmY:bxUqtJCAk7VRUi

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

a20f20fa2352a77b6d4c69fa3314d3f14b97a7e1603144d54cc70fc83e18afa8
.exe windows x86

de047446f094c804e11717e5e52df5ad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

KeDelayExecutionThread
ZwCreateFile
PsCreateSystemThread
ZwQueryValueKey
ZwQueryDirectoryFile
PsTerminateSystemThread
ZwQueryInformationProcess
ZwCreateSection
ZwEnumerateKey
memcpy
ExAllocatePoolWithTag
ExFreePoolWithTag
_wcsnicmp
ExGetPreviousMode
KeDetachProcess
wcslen
IoGetCurrentProcess
MmMapViewOfSection
ObReferenceObjectByHandle
KeAttachProcess
ZwOpenProcess
KeServiceDescriptorTable
RtlCompareMemory
PsGetCurrentProcessId
MmIsAddressValid
ObfDereferenceObject
MmSectionObjectType
ZwOpenKey
ZwReadFile
MmUnmapViewOfSection
ZwSetValueKey
ObQueryNameString
RtlCompareUnicodeString
RtlUnicodeStringToAnsiString
ZwWriteFile
ZwClose
IoCreateFile
RtlInitUnicodeString
_except_handler3

hal

KfLowerIrql
KeGetCurrentIrql
KfRaiseIrql

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

de047446f094c804e11717e5e52df5ad

Headers

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: 7KB - Virtual size: 6KB

.data Size: 29KB - Virtual size: 28KB

INIT Size: 1KB - Virtual size: 1KB

.vmp0 Size: 1024B - Virtual size: 572B

.vmp1 Size: 17KB - Virtual size: 17KB

.reloc Size: 512B - Virtual size: 320B

.text
Size: 7KB - Virtual size: 6KB

.data
Size: 29KB - Virtual size: 28KB

INIT
Size: 1KB - Virtual size: 1KB

.vmp0
Size: 1024B - Virtual size: 572B

.vmp1
Size: 17KB - Virtual size: 17KB

.reloc
Size: 512B - Virtual size: 320B