General
-
Target
98ff83aa60ac3db4b22a864c09b7947f7def34a1f00d1f0eca388623365c9d80
-
Size
1.1MB
-
MD5
38eb6a51e52969b019f6307787ba3490
-
SHA1
da5e209cee4a82e2b8d4b10240150b51a1b2bd3f
-
SHA256
98ff83aa60ac3db4b22a864c09b7947f7def34a1f00d1f0eca388623365c9d80
-
SHA512
742a98438f30b8e5457b077f723291764d0824ee9fbc12b06db133302c9e9f444daf0927b07e3fc4ce762156fd604d562bff585930c9b7b4ff69dc527539aa0e
-
SSDEEP
12288:sFn6o3FeN4Ddfv9g23kw+D18aZwezBNQu/HRNwy0kjG7BxQxn24o:g/3FeQg20Z18azNQ4Iy0kCT224
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
98ff83aa60ac3db4b22a864c09b7947f7def34a1f00d1f0eca388623365c9d80.exe windows x86
4de6f77def86f68ea6fcd69718b02d01
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Sections
.text Size: - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 374KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 604KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 696KB - Virtual size: 695KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 176KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ