337bb80a9ca72c2e656be06eb6d576663b3d9f7249131c012bd612ca994c0500

Sharing

Copy URL

Twitter E-mail

General

Target

337bb80a9ca72c2e656be06eb6d576663b3d9f7249131c012bd612ca994c0500
Size

4.8MB
MD5

c9c51220e7dd793879c46b488c6ab561
SHA1

635b8551d41deb4aed2d9cff983859315e8b0402
SHA256

337bb80a9ca72c2e656be06eb6d576663b3d9f7249131c012bd612ca994c0500
SHA512

2e521bf2c2ec16e14b49351936fef811c7e65812b1108a786bb8bd0364c2f73264d2d1e3d8cc70c5cf43799665e59aef6fb3b6f3fee4c6aa3c3e273ca6394fce
SSDEEP

98304:+GJEBpmfZGil8vmdBgDI3pGfBxzB7i43f6b9vL5dxB:+GE89l8vm0I3p8xzB7oVL5DB

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
337bb80a9ca72c2e656be06eb6d576663b3d9f7249131c012bd612ca994c0500

Files

337bb80a9ca72c2e656be06eb6d576663b3d9f7249131c012bd612ca994c0500
.exe windows:5 windows x86

dd6bc9814c43653336a877ccf8d1ccaf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
SuspendThread
ResumeThread
GetModuleHandleA
OpenProcess
HeapSize
GetLastError
LockResource
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
QueueUserAPC
HeapDestroy
VirtualAllocEx
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
CreateProcessA
VirtualProtect
VirtualFree
VirtualAlloc
WaitForSingleObject
LoadLibraryA
FreeLibrary
CreateRemoteThread
VirtualFreeEx
IsBadReadPtr
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
HeapFree
WriteProcessMemory
SizeofResource
GetProcAddress
CreateEventW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
IsDebuggerPresent
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree

oleaut32

vcruntime140

__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memset
__vcrt_InitializeCriticalSectionEx
__std_exception_copy
_except_handler4_common
memcpy

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
__p___argv
_initterm
_errno
__p___argc
_get_initial_narrow_environment
_invalid_parameter_noinfo
_controlfp_s
_set_app_type
_seh_filter_exe
_exit
exit
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_cexit
_initterm_e

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh
_set_new_mode

api-ms-win-crt-string-l1-1-0

strnlen

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

InjectRemoteProcess

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dd6bc9814c43653336a877ccf8d1ccaf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

oleaut32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 4KB - Virtual size: 4KB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 4KB - Virtual size: 4KB

.vmp0 Size: 1.5MB - Virtual size: 1.5MB

.vmp1 Size: 3.2MB - Virtual size: 3.2MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 4KB

.l1 Size: 5KB - Virtual size: 5KB

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 4KB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 4KB - Virtual size: 4KB

.vmp0
Size: 1.5MB - Virtual size: 1.5MB

.vmp1
Size: 3.2MB - Virtual size: 3.2MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.l1
Size: 5KB - Virtual size: 5KB