0e39186620afa11e0f20dbc1eafc1c2bdf7b869f4955774c3e06d79e47e2723c

Sharing

Copy URL Twitter E-mail

General

Target

0e39186620afa11e0f20dbc1eafc1c2bdf7b869f4955774c3e06d79e47e2723c
Size

5.4MB
MD5

334820533803e72638e1ccc15d87b7b7
SHA1

8ec8bfaca1ffa18f2ebd72731bedd2665487fa23
SHA256

0e39186620afa11e0f20dbc1eafc1c2bdf7b869f4955774c3e06d79e47e2723c
SHA512

8ef944220ae4f64131beafe996cc02a4e105d91115a81523ee5f8d0c82cf85acb8a5d81eb7ee103545ae8519c0b3619d3bfa7ff38ff6864fd8a0adf1cdd62b34
SSDEEP

98304:BK5c78q48aPS9+sPrwUiYutJs4p2O1j6jfev1aCL/GS+dl87PdoVLxe/EgaGgDRv:Ycl7aqbJiHtJs4s5jfg1aOqdlzVGEgBe

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

0e39186620afa11e0f20dbc1eafc1c2bdf7b869f4955774c3e06d79e47e2723c
.exe windows x86

dc20c1aabbd1b409b1f64b660b50be42

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

iphlpapi

GetAdaptersInfo

winmm

waveOutReset

ws2_32

send

version

VerQueryValueA

kernel32

GetCommandLineA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

IsWindow

gdi32

CreateRoundRectRgn

winspool.drv

ClosePrinter

advapi32

RegQueryValueExA

shell32

DragFinish

ole32

CoTaskMemAlloc

oleaut32

LHashValOfNameSys

comctl32

ImageList_BeginDrag

oledlg

ord8

comdlg32

GetSaveFileNameA

Sections

.text
Size: - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 958KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 337KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc20c1aabbd1b409b1f64b660b50be42

Headers

File Characteristics

Imports

iphlpapi

winmm

ws2_32

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

comdlg32

Sections

.text Size: - Virtual size: 2.4MB

.rdata Size: - Virtual size: 958KB

.data Size: - Virtual size: 337KB

.vmp0 Size: - Virtual size: 4.0MB

.vmp1 Size: 5.4MB - Virtual size: 5.4MB

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: - Virtual size: 2.4MB

.rdata
Size: - Virtual size: 958KB

.data
Size: - Virtual size: 337KB

.vmp0
Size: - Virtual size: 4.0MB

.vmp1
Size: 5.4MB - Virtual size: 5.4MB

.rsrc
Size: 8KB - Virtual size: 4KB