f8427ebf6367ad98a5bfcc71433421095cf506f10ed11d7e22525e2b8cd88c48

Sharing

Copy URL Twitter E-mail

General

Target

f8427ebf6367ad98a5bfcc71433421095cf506f10ed11d7e22525e2b8cd88c48
Size

2.8MB
MD5

a481d7c621412ddd191afb89351c9086
SHA1

d77d7b3e0f0207017ebff12d46f38ae8ab195e9a
SHA256

f8427ebf6367ad98a5bfcc71433421095cf506f10ed11d7e22525e2b8cd88c48
SHA512

58646a84aa0ed334c168587fe296fa6f7f6f4bf079bbbeeccb07c371aa50bed8ceb02c5a5259aac9d93d3d215b68a9e860ee94678e1729e400b56e97c7341a75
SSDEEP

49152:uV6dzd4WCjLI7BRehhgDFbqo9L0qQLu83DjIWG8T7DMPwerLJe+K:uVzWCHhhwbD9IqQysDjIWGwarLJel

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

f8427ebf6367ad98a5bfcc71433421095cf506f10ed11d7e22525e2b8cd88c48
.exe windows x86

c9b3110e1ae9faf196a39294eee02358

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryW
GetTickCount
WriteFile
GetLastError
SizeofResource
LockResource
LoadResource
DeleteFileW
GetNativeSystemInfo
GetCurrentProcess
IsBadWritePtr
WideCharToMultiByte
IsBadReadPtr
GetVolumeInformationW
LocalFree
FindResourceW
LoadLibraryW
GetModuleHandleW
GetProcAddress
GetDriveTypeW
GetLogicalDriveStringsW
GetLocalTime
Sleep
GetCurrentProcessId
WritePrivateProfileStringW
GetPrivateProfileStringW
MultiByteToWideChar
ExitProcess
DeviceIoControl
GetACP
MulDiv
InterlockedIncrement
InterlockedDecrement
lstrcpyW
SetFilePointer
GetFileType
DuplicateHandle
ReadFile
SystemTimeToFileTime
DosDateTimeToFileTime
CreateDirectoryW
SetFileTime
GetFileSize
GlobalUnlock
GlobalLock
GlobalAlloc
HeapAlloc
HeapFree
GetTimeFormatA
GetDateFormatA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
HeapReAlloc
GetSystemTimeAsFileTime
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringA
LCMapStringW
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
QueryPerformanceCounter
HeapSize
GetModuleHandleA
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
InitializeCriticalSection
lstrcpyn
GetExitCodeThread
GetProcessHeap
RtlMoveMemory
GetVolumeInformationA
OpenMutexA
TerminateThread
CreateMutexA
CreateThread
GetEnvironmentVariableA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetCommandLineA
GetVersion
FreeEnvironmentStringsA
GetEnvironmentStrings
GetVersionExA
IsBadCodePtr
CloseHandle
CreateFileW
FreeResource
GetModuleFileNameW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CallWindowProcW
GetWindowLongW
GetPropW
SetPropW
PostMessageW
RegisterClassW
LoadCursorW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
GetKeyState
UnionRect
InvalidateRect
SetTimer
KillTimer
SetCapture
ReleaseCapture
ScreenToClient
PtInRect
CharNextW
GetFocus
MapWindowPoints
IntersectRect
GetUpdateRect
IsRectEmpty
EndPaint
BeginPaint
GetActiveWindow
GetCursorPos
GetWindowRgn
MoveWindow
IsZoomed
SetWindowRgn
OffsetRect
GetSystemMetrics
SetCursor
wvsprintfW
GetWindowTextW
GetWindowTextLengthW
GetCaretPos
GetCaretBlinkTime
FillRect
InvalidateRgn
GetGUIThreadInfo
CreateAcceleratorTableW
SetForegroundWindow
DrawTextW
CharPrevW
SetRect
CreateCaret
HideCaret
ShowCaret
SetCaretPos
GetSysColor
GetMessageA
DispatchMessageA
wsprintfA
PeekMessageA
DispatchMessageW
IsWindow
SetWindowLongW
DefWindowProcW
LoadImageW
SendMessageW
EnableWindow
GetMessageW
wsprintfW
GetWindowRect
GetParent
GetWindow
GetMonitorInfoW
MonitorFromWindow
IsIconic
SetWindowPos
EnumDisplayDevicesW
SetFocus
ClientToScreen
DestroyWindow
PostQuitMessage
ShowWindow
SetWindowTextW
GetClientRect
IsWindowVisible
MessageBoxW
MessageBoxA
ReleaseDC
GetDC
TranslateMessage

gdi32

SaveDC
BitBlt
RestoreDC
CreateCompatibleBitmap
CreateCompatibleDC
PtInRegion
Rectangle
SetWindowOrgEx
DeleteDC
GdiFlush
TextOutW
GetCharABCWidthsW
GetTextExtentPoint32W
RoundRect
CreateRoundRectRgn
MoveToEx
LineTo
SetBkColor
ExtTextOutW
SetStretchBltMode
StretchBlt
CombineRgn
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
SelectClipRgn
SetBkMode
SetTextColor
CreatePatternBrush
CreateSolidBrush
GetDeviceCaps
CreateDIBSection
CreatePenIndirect
CreateRectRgn
CreatePen
GetStockObject
GetObjectW
SelectObject
CreateFontIndirectW
DeleteObject
GetObjectA
GetTextMetricsW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

CreateServiceW
DeleteService
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CloseServiceHandle
StartServiceW
GetSecurityInfo
SetEntriesInAclW
SetSecurityInfo
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW

shell32

ShellExecuteW

ole32

CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
StringFromCLSID

comctl32

_TrackMouseEvent
ord17

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

winmm

waveOutGetDevCapsW
waveOutGetNumDevs

imm32

ImmSetCompositionWindow
ImmSetCompositionFontW
ImmReleaseContext
ImmGetContext

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

gdiplus

GdipGetPropertyItem
GdipGetPropertyItemSize
GdipGetImageHeight
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdiplusShutdown
GdipFree
GdipAlloc
GdipDeleteBrush
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteGraphics
GdipDeleteFontFamily
GdipDeleteFont
GdipDisposeImage
GdipCreateBitmapFromScan0
GdiplusStartup
GdipCreateLineBrushI
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateFromHDC
GdipGetImageGraphicsContext
GdipSetCompositingQuality
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipGraphicsClear
GdipDrawString
GdipDrawImage
GdipDrawImageRectI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipGetFamily
GdipCloneBrush
GdipCloneImage
GdipLoadImageFromStream

Sections

.text
Size: - Virtual size: 656KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 794KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9b3110e1ae9faf196a39294eee02358

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

comctl32

iphlpapi

winmm

imm32

oleaut32

gdiplus

Sections

.text Size: - Virtual size: 656KB

.rdata Size: - Virtual size: 101KB

.data Size: - Virtual size: 115KB

.vmp0 Size: - Virtual size: 1.5MB

.vmp1 Size: 2.8MB - Virtual size: 2.8MB

.reloc Size: 512B - Virtual size: 136B

.rsrc Size: 20KB - Virtual size: 794KB

.text
Size: - Virtual size: 656KB

.rdata
Size: - Virtual size: 101KB

.data
Size: - Virtual size: 115KB

.vmp0
Size: - Virtual size: 1.5MB

.vmp1
Size: 2.8MB - Virtual size: 2.8MB

.reloc
Size: 512B - Virtual size: 136B

.rsrc
Size: 20KB - Virtual size: 794KB