General
-
Target
5a98af82a44dfa4fd08278229619c68779636b5345896e1a02625053f040c067
-
Size
1.1MB
-
MD5
06827fe35b3d06ed64e6465a13fa9112
-
SHA1
b0a25fb9646219ab481d7d2d40255831aa3f0b39
-
SHA256
5a98af82a44dfa4fd08278229619c68779636b5345896e1a02625053f040c067
-
SHA512
f7b2a95803cd7f9cae7fdd668b4185f9c482b6f33496112e52c8df8c7851c10ee79a5850469fbc57fccca504e4d9be47c768887cbce84bcfa4d9aa435672e889
-
SSDEEP
12288:PqrQ5VX/+dORV6WJXCI58QKoEiVg8N/I0y/eaULIam/6my2UtNmpU6Ok9vuet7Xi:CQX/+0RcQVEiV/I0y/eaULIarHqmSt
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
5a98af82a44dfa4fd08278229619c68779636b5345896e1a02625053f040c067.exe windows x86
193d9a875066797beaf6fad953d502c3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Sections
.text Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 612KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 692KB - Virtual size: 691KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 176KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ