6dd7f04cb3ff559fc595af98940861fd30458278099842b6dca19393e9f1eede

Sharing

Copy URL Twitter E-mail

General

Target

6dd7f04cb3ff559fc595af98940861fd30458278099842b6dca19393e9f1eede
Size

5.4MB
MD5

c5917c988111837cf0e5d4c3af747e5e
SHA1

d573237d66ff042f77ab6a0f8e44e2ab9d30f9ac
SHA256

6dd7f04cb3ff559fc595af98940861fd30458278099842b6dca19393e9f1eede
SHA512

3c421abfc6386b0156492c3652a152325bcf8021d1a26ad117336f54be57c5bb95c232242dc3925b520d8543d710f64b263934ef608a4f529a98bcf4810c405a
SSDEEP

98304:huXC1vMGbv60OW6b4XAmRb+RaiQMI3u8OcEOQ9oYRxpoG+Zd+dwiLF:hj9j6UkuMZRGQSeoz+F

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

6dd7f04cb3ff559fc595af98940861fd30458278099842b6dca19393e9f1eede
.exe windows x86

3178817b59de283262fb8eb40b1d54f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
GetVersionExA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA

user32

UpdateWindow

gdi32

GetViewportExtEx

msimg32

AlphaBlend

comdlg32

GetOpenFileNameW

winspool.drv

OpenPrinterW

advapi32

ReportEventA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

SHGetSpecialFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionW

ole32

CreateStreamOnHGlobal

oleaut32

OleCreateFontIndirect

oledlg

OleUIBusyW

gdiplus

GdipGetImageWidth

ws2_32

__WSAFDIsSet

rasapi32

RasHangUpW

iphlpapi

GetAdaptersInfo

wininet

InternetCrackUrlW

winhttp

WinHttpReceiveResponse

version

VerQueryValueW

dbghelp

MiniDumpWriteDump

oleacc

LresultFromObject

Exports

Exports

OSPX_edesc
OSPX_efunc
OSPX_error_register
OSPX_error_unregister
OSPX_errprefix
OSPX_errprefix_append
OSPX_errprefix_clr
OSPX_getlasterror
OSPX_gettimeofday
OSPX_library_end
OSPX_library_init
OSPX_pthread_cond_broadcast
OSPX_pthread_cond_destroy
OSPX_pthread_cond_init
OSPX_pthread_cond_signal
OSPX_pthread_cond_timedwait
OSPX_pthread_create
OSPX_pthread_detach
OSPX_pthread_join
OSPX_pthread_once
OSPX_pthread_rwlock_destroy
OSPX_pthread_rwlock_init
OSPX_pthread_rwlock_rdlock
OSPX_pthread_rwlock_tryrdlock
OSPX_pthread_rwlock_trywrlock
OSPX_pthread_rwlock_unlock
OSPX_pthread_rwlock_wrlock
OSPX_pthread_self
OSPX_sem_destroy
OSPX_sem_getvalue
OSPX_sem_init
OSPX_sem_post
OSPX_sem_timedwait
OSPX_sem_wait
OSPX_setlasterror
OSPX_setlasterror2
OSPX_strerror
OSPX_sys_strerror
stpool_add_routine
stpool_addref
stpool_adjust
stpool_adjust_abs
stpool_caps
stpool_create
stpool_create_byfac
stpool_desc
stpool_factory_list2
stpool_flush
stpool_mark_all
stpool_mark_cb
stpool_release
stpool_remove_all
stpool_resume
stpool_scheduler_map_dump2
stpool_set_activetimeo
stpool_stat
stpool_stat_print
stpool_stat_print2
stpool_strerror
stpool_suspend
stpool_task_clone
stpool_task_deinit
stpool_task_delete
stpool_task_detach
stpool_task_get_userflags
stpool_task_getschattr
stpool_task_init
stpool_task_is_free
stpool_task_mark
stpool_task_new
stpool_task_p
stpool_task_pname
stpool_task_pthrottle_wait
stpool_task_queue
stpool_task_remove
stpool_task_set_p
stpool_task_set_userflags
stpool_task_setschattr
stpool_task_size
stpool_task_stat
stpool_task_stat2
stpool_task_vm
stpool_task_wait
stpool_task_wait_all
stpool_task_wait_any
stpool_thread_getscheattr
stpool_thread_setscheattr
stpool_throttle_enable
stpool_throttle_wait
stpool_version
stpool_wait_all
stpool_wait_any
stpool_wait_cb
stpool_wakeid
stpool_wakeup

Sections

.text
Size: - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1002KB - Virtual size: 1001KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 654KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3178817b59de283262fb8eb40b1d54f8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

gdiplus

ws2_32

rasapi32

iphlpapi

wininet

winhttp

version

dbghelp

oleacc

Exports

Exports

Sections

.text Size: - Virtual size: 3.8MB

.rdata Size: 1002KB - Virtual size: 1001KB

.data Size: - Virtual size: 103KB

.vmp0 Size: - Virtual size: 654KB

.vmp1 Size: 4.3MB - Virtual size: 4.3MB

.reloc Size: 84KB - Virtual size: 83KB

.rsrc Size: 12KB - Virtual size: 5.4MB

.text
Size: - Virtual size: 3.8MB

.rdata
Size: 1002KB - Virtual size: 1001KB

.data
Size: - Virtual size: 103KB

.vmp0
Size: - Virtual size: 654KB

.vmp1
Size: 4.3MB - Virtual size: 4.3MB

.reloc
Size: 84KB - Virtual size: 83KB

.rsrc
Size: 12KB - Virtual size: 5.4MB