7956d8c7e88eac618a2918ee6298055200d8f006f8e862282ea1e424c3757769

Sharing

Copy URL Twitter E-mail

General

Target

7956d8c7e88eac618a2918ee6298055200d8f006f8e862282ea1e424c3757769
Size

1.9MB
MD5

3102ac025cc6fd3c738baebbd67e0e4c
SHA1

2a5d96eeca769a87a77e07664ff98c123a68e4bf
SHA256

7956d8c7e88eac618a2918ee6298055200d8f006f8e862282ea1e424c3757769
SHA512

f53c41ccc5da705690e7d0ced1bbf7fceb19680869cf2816262c75268b257afc6a07d43310905e23165103d7d7c4f00a550cd02f4ba4df111c12a4519b94f99e
SSDEEP

49152:PDHMKCiUzDffvnf/+p4003RGKLnHpTzWt4oS9iM:IDffvnHdr3RGKLnHpTz4Q9i

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

7956d8c7e88eac618a2918ee6298055200d8f006f8e862282ea1e424c3757769
.dll windows x86

9dceb8dd889c504c2128210ba7e57d93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA

user32

IsWindowVisible
CharUpperBuffW

comdlg32

GetSaveFileNameA

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ

ws2_32

ioctlsocket

vcruntime140

__current_exception_context

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-runtime-l1-1-0

_beginthreadex

api-ms-win-crt-filesystem-l1-1-0

_mkdir

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-math-l1-1-0

ceil

wtsapi32

WTSSendMessageW

advapi32

RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

Sections

.text
Size: - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9dceb8dd889c504c2128210ba7e57d93

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

comdlg32

msvcp140

ws2_32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

wtsapi32

advapi32

Sections

.text Size: - Virtual size: 102KB

.rdata Size: - Virtual size: 24KB

.data Size: - Virtual size: 3KB

.vmp0 Size: - Virtual size: 1.9MB

.vmp1 Size: 1.9MB - Virtual size: 1.9MB

.reloc Size: 512B - Virtual size: 264B

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 102KB

.rdata
Size: - Virtual size: 24KB

.data
Size: - Virtual size: 3KB

.vmp0
Size: - Virtual size: 1.9MB

.vmp1
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 512B - Virtual size: 264B

.rsrc
Size: 1KB - Virtual size: 1KB