30bb408312ad76f6700e619fe14af9c04ff4ef7ac3f41f7bb7dbbed1bcfbdccb

Sharing

Copy URL

Twitter E-mail

General

Target

30bb408312ad76f6700e619fe14af9c04ff4ef7ac3f41f7bb7dbbed1bcfbdccb
Size

6.3MB
MD5

54c64f083c0387d198644e43f9326224
SHA1

6b7fa515c0499d8fb29a396e31e9988f4808d048
SHA256

30bb408312ad76f6700e619fe14af9c04ff4ef7ac3f41f7bb7dbbed1bcfbdccb
SHA512

c4da26d5287f5427b8ced92a06a01b657b21fcebd986385b766c41c8b02c3443d503dcc100a94b6428ffed38545e563be52f43db75a72d03cae5af84bf92c711
SSDEEP

98304:llCvhin1ANEqd5A/Iy0PY1cAx9Zd6szjq9oh/QwZ9CdxQNGRnPzLohUqyK:llaFEqd5eIMxTd6mqg/ZvNGRPzRHK

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

30bb408312ad76f6700e619fe14af9c04ff4ef7ac3f41f7bb7dbbed1bcfbdccb
.exe windows x86

0698a7da9844046b10e74253f2e67873

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

midiStreamOpen

ws2_32

recvfrom

rasapi32

RasHangUpA

kernel32

GlobalDeleteAtom
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess

user32

CreateIconFromResourceEx

gdi32

GetClipBox

winspool.drv

ClosePrinter

advapi32

RegQueryValueA

shell32

Shell_NotifyIconA

ole32

CoRegisterMessageFilter

oleaut32

SafeArrayGetElemsize

comctl32

ord17

oledlg

ord8

wininet

InternetCanonicalizeUrlA

comdlg32

GetOpenFileNameA

Sections

.text
Size: - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 738KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0698a7da9844046b10e74253f2e67873

Headers

File Characteristics

Imports

winmm

ws2_32

rasapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

wininet

comdlg32

Sections

.text Size: - Virtual size: 525KB

.rdata Size: - Virtual size: 5.6MB

.data Size: - Virtual size: 316KB

.rsrc Size: 8KB - Virtual size: 22KB

.vmp0 Size: - Virtual size: 738KB

.tls Size: 4KB - Virtual size: 24B

.vmp1 Size: 6.3MB - Virtual size: 6.3MB

.text
Size: - Virtual size: 525KB

.rdata
Size: - Virtual size: 5.6MB

.data
Size: - Virtual size: 316KB

.rsrc
Size: 8KB - Virtual size: 22KB

.vmp0
Size: - Virtual size: 738KB

.tls
Size: 4KB - Virtual size: 24B

.vmp1
Size: 6.3MB - Virtual size: 6.3MB