98faeca7b92762efef485c925999bd081a8c8921bd794f84c25629f49e56557f

Sharing

Copy URL Twitter E-mail

General

Target

98faeca7b92762efef485c925999bd081a8c8921bd794f84c25629f49e56557f
Size

2.1MB
MD5

f17775ac7171d3e0a16de14c1c42c380
SHA1

922b4744b345d899dc6dd16fdfb1613b2cbe5edc
SHA256

98faeca7b92762efef485c925999bd081a8c8921bd794f84c25629f49e56557f
SHA512

fb150854fba7f1ab106df43c5939c86e03c7b5794b1a8a9c1ae58de9aa908c873a159800fba4da963e755c4f8b9b5605906788096e09341fa91d5fe907862ac6
SSDEEP

49152:bMggm3+QPUBKtcdjH7yCAaPn45Ic5wANpVbj2Chge+F:wgg7TBKtSHyNaPI1byChge

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

98faeca7b92762efef485c925999bd081a8c8921bd794f84c25629f49e56557f
.exe windows x86

9fc1b8951e9a5bd6e545ac48098f3b86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

sapclassbasic83

?GetResourceCount@SapManager@@SAHPBDH@Z

mvcameracontrol

MV_CC_EnumDevices

unicontrol

UCC_GetCameraInfoString

vimbac

ord7

mfc140

ord1765

kernel32

WriteFile
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetSystemMenu
CharUpperBuffW

comctl32

ord17

msvcp140

?_Xlength_error@std@@YAXPBD@Z

ws2_32

WSAStartup

vcruntime140

_purecall

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-math-l1-1-0

_libm_sse2_pow_precise

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-locale-l1-1-0

_setmbcp

wtsapi32

WTSSendMessageW

advapi32

RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

Sections

.text
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9fc1b8951e9a5bd6e545ac48098f3b86

Headers

DLL Characteristics

File Characteristics

Imports

sapclassbasic83

mvcameracontrol

unicontrol

vimbac

mfc140

kernel32

user32

comctl32

msvcp140

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

advapi32

Sections

.text Size: - Virtual size: 72KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: - Virtual size: 1KB

.vmp0 Size: - Virtual size: 2.1MB

.vmp1 Size: 2.1MB - Virtual size: 2.1MB

.reloc Size: 2KB - Virtual size: 2KB

.rsrc Size: 8KB - Virtual size: 8KB

.text
Size: - Virtual size: 72KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: - Virtual size: 1KB

.vmp0
Size: - Virtual size: 2.1MB

.vmp1
Size: 2.1MB - Virtual size: 2.1MB

.reloc
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 8KB - Virtual size: 8KB