6efa57afd03904064407234dbb0081353d5d233b73643a26d3806bfbc9c65a00

Sharing

Copy URL Twitter E-mail

General

Target

6efa57afd03904064407234dbb0081353d5d233b73643a26d3806bfbc9c65a00
Size

1.4MB
MD5

cc68eb58d6a11243dc9e6c4024950f30
SHA1

37bb97ec5e05d148b5c63082d533e22cb9fc1949
SHA256

6efa57afd03904064407234dbb0081353d5d233b73643a26d3806bfbc9c65a00
SHA512

9da5db0159b0d7542d0d8cb5279d1aa3059ebfd56fb16cac7c65c7712c0816b940e2fc782e9942918ba909b7c9ce169f036f289bee2e9676854ac2d74f5fcddb
SSDEEP

24576:xrLJXQR/Sip/ILltM+2ECDKxSBobpYUcwPfjW0maxlY2grRzRbdo1F9pXB9zsgQy:BJXQX9gM+2abpiwP5jx6T3o1F9pxS5Nz

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

6efa57afd03904064407234dbb0081353d5d233b73643a26d3806bfbc9c65a00
.exe windows x86

7b554031393c56fdd23ec3e7f381e1e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetWindowLongA

gdi32

DeleteDC

winmm

midiStreamRestart

winspool.drv

ClosePrinter

advapi32

RegSetValueExA

shell32

SHGetMalloc

ole32

CoTaskMemFree

oleaut32

RegisterTypeLi

comctl32

ImageList_Destroy

oledlg

ord8

ws2_32

recv

comdlg32

ChooseFontA

Sections

.text
Size: - Virtual size: 643KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 851KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7b554031393c56fdd23ec3e7f381e1e4

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

ws2_32

comdlg32

Sections

.text Size: - Virtual size: 643KB

.rdata Size: - Virtual size: 233KB

.data Size: - Virtual size: 211KB

.vmp0 Size: - Virtual size: 851KB

.vmp1 Size: 1.4MB - Virtual size: 1.4MB

.rsrc Size: 16KB - Virtual size: 12KB

.text
Size: - Virtual size: 643KB

.rdata
Size: - Virtual size: 233KB

.data
Size: - Virtual size: 211KB

.vmp0
Size: - Virtual size: 851KB

.vmp1
Size: 1.4MB - Virtual size: 1.4MB

.rsrc
Size: 16KB - Virtual size: 12KB