fc84e38f0f001f4bb20e974386024bc1a5de89dede31a16701388adbab666144

Sharing

Copy URL Twitter E-mail

General

Target

fc84e38f0f001f4bb20e974386024bc1a5de89dede31a16701388adbab666144
Size

4.7MB
MD5

842ed53cbba979b2da3ef71525f12f89
SHA1

ccc1f27bdfd251da7f7c90cc54e03dbaf2410aac
SHA256

fc84e38f0f001f4bb20e974386024bc1a5de89dede31a16701388adbab666144
SHA512

77e5e5ac2e8be178a5a7441915eba066c0d21dfab4781e433e10260005acbf74be5cade65b38f272b9fa000a8481f13de3a6a0dc2f458663a169a5708beb49fc
SSDEEP

98304:G4Czdj1ACQ2Pp8kTijq0zFLcYDmLUcIbAUvHhWo:G4Kj1ENkADFAhUJWo

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc84e38f0f001f4bb20e974386024bc1a5de89dede31a16701388adbab666144

Files

fc84e38f0f001f4bb20e974386024bc1a5de89dede31a16701388adbab666144
.dll windows:6 windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

??0ActivationData@TSCLicensing@@QEAA@PEBDW4ActivationType@1@@Z
??0ActivationData@TSCLicensing@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4ActivationType@1@@Z
??0ActivationData@TSCLicensing@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4ActivationType@1@@Z
??0LeaseRefreshChecker@TSCLicensing@@QEAA@V?$shared_ptr@VIDataFetcher@TSCLicensing@@@std@@V?$shared_ptr@VISecureCache@TSCLicensing@@@3@@Z
??0LicensingService@@QEAA@V?$shared_ptr@VILicenseProvidersFactory@@@std@@AEAULicensingError@@@Z
??0NalpeironLicensingConfiguration@@QEAA@HHHHHHHH_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@111UNalpeironSystemInfo@@W4Environment@TSCLicensing@@V?$shared_ptr@VIGetProxyInfo@TSCLicensing@@@2@@Z
??0NalpeironSystemInfo@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000@Z
??0OfflineActivationData@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??0PassiveActivationData@TSCLicensing@@QEAA@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??0PassiveNalpeironLicenseConfiguration@TSCLicensing@@QEAA@HHHHHHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00UNalpeironSystemInfo@@@Z
??0ServiceConfiguration@TSCLicensing@@QEAA@V?$shared_ptr@VILicensingConfiguration@@@std@@V?$shared_ptr@VActivationData@TSCLicensing@@@3@V?$shared_ptr@VIRedirectBuilder@@@3@@Z
??8CacheClearedEventArgs@Events@TSCLicensing@@QEBA_NAEAV012@@Z
??8ObtainedLicenseEventArgs@Events@TSCLicensing@@QEBA_NAEBV012@@Z
?Activate@LicensingService@@UEAA?AULicensingError@@V?$shared_ptr@VActivationData@TSCLicensing@@@std@@@Z
?ActivateAsync@LicensingService@@UEAA?AV?$future@ULicensingError@@@std@@V?$shared_ptr@VActivationData@TSCLicensing@@@3@@Z
?ActivationError@ObtainedLicenseEventArgs@Events@TSCLicensing@@QEBA?AW4ActivationErrorCode@@XZ
?ActivationError@WarningEventArgs@Events@TSCLicensing@@QEBA?AW4ActivationErrorCode@@XZ
?BuildNumber@NalpeironSystemInfo@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?CompleteOfflineActivationAsync@LicensingService@@UEAA?AV?$future@ULicensingError@@@std@@UOfflineActivationData@@@Z
?CompleteOfflineDeactivationAsync@LicensingService@@UEAA?AV?$future@ULicensingError@@@std@@XZ
?CreateLicensingService@LicensingServiceFactory@@UEAA?AV?$shared_ptr@VILicensingService@@@std@@AEAULicensingError@@@Z
?EditionId@NalpeironSystemInfo@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Error@BasicEventArgs@Events@TSCLicensing@@QEBAHXZ
?ErrorMessage@CacheClearedEventArgs@Events@TSCLicensing@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?EventListeners@LicensingService@@UEAAAEAVIEventSystem@Events@TSCLicensing@@XZ
?ExpirationDate@WarningEventArgs@Events@TSCLicensing@@QEBA_JXZ
?FullProductVersion@NalpeironSystemInfo@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetActivationData@ObtainingLicenseEventArgs@Events@TSCLicensing@@QEBA?AVActivationData@3@XZ
?GetActivationType@ActivationData@TSCLicensing@@UEAA?AW4ActivationType@2@XZ
?GetCertificate@PassiveActivationData@TSCLicensing@@QEAA?BV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetCurrentActivationType@LicensingService@@UEAA?AV?$optional@W4ActivationType@TSCLicensing@@@std@@AEAULicensingError@@@Z
?GetHoursUntilHardLicenseRefreshRequired@LicensingService@@UEAA?AULicensingError@@AEAH@Z
?GetHoursUntilSoftLicenseRefreshExpected@LicensingService@@UEAA?AULicensingError@@AEAH@Z
?GetLicenseIdentifier@ActivationData@TSCLicensing@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetLicenseType@LicensingService@@UEAA?AW4LicenseType@TSCLicensing@@AEAULicensingError@@@Z
?GetLicenseValidationStatus@LicensingService@@UEAA?AULicensingError@@XZ
?GetLicenseValue@LicensingService@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4LicenseDataValueType@TSCLicensing@@AEAULicensingError@@@Z
?GetSeatCountType@LicensingService@@UEAA?AW4SeatCountType@TSCLicensing@@AEAULicensingError@@@Z
?GetSubscriptionData@LicensingService@@UEAA?BUSubscriptionData@TSCLicensing@@AEAULicensingError@@@Z
?GetToken@ActivationData@TSCLicensing@@UEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?InitializeLicensing@LicensingService@@UEAA?AULicensingError@@V?$shared_ptr@VServiceConfiguration@TSCLicensing@@@std@@@Z
?InitializeLicensingAsync@LicensingService@@UEAA?AV?$future@ULicensingError@@@std@@V?$shared_ptr@VServiceConfiguration@TSCLicensing@@@3@@Z
?InstallLang@NalpeironSystemInfo@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Instance@EventSystem@Events@TSCLicensing@@SAPEAVIEventSystem@23@XZ
?IsFromCache@ObtainedLicenseEventArgs@Events@TSCLicensing@@QEBA?B_NXZ
?IsLicenseValid@LicensingService@@UEAA_NAEAULicensingError@@@Z
?IsLicenseValidAsync@LicensingService@@UEAA?AV?$future@_N@std@@AEAULicensingError@@@Z
?IsOfflineActivated@LicensingService@@UEAA_NAEAULicensingError@@@Z
?IsPastLeaseRefreshPeriod@LeaseRefreshChecker@TSCLicensing@@UEBA_NXZ
?IsVM@BasicEventArgs@Events@TSCLicensing@@QEBA?B_NXZ
?Key@OfflineActivationData@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?LeaseRefreshDate@ObtainedLicenseEventArgs@Events@TSCLicensing@@QEBA?AV?$time_point@Usystem_clock@chrono@std@@V?$duration@_JU?$ratio@$00$0JIJGIA@@std@@@23@@chrono@std@@XZ
?LicenseCertificate@OfflineActivationData@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?LicenseExpirationDate@ObtainedLicenseEventArgs@Events@TSCLicensing@@QEBA?AV?$time_point@Usystem_clock@chrono@std@@V?$duration@_JU?$ratio@$00$0JIJGIA@@std@@@23@@chrono@std@@XZ
?LicenseOwner@ObtainedLicenseEventArgs@Events@TSCLicensing@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?LicenseType@ObtainedLicenseEventArgs@Events@TSCLicensing@@QEBA?AW403@XZ
?Reason@CacheClearedEventArgs@Events@TSCLicensing@@QEBA?BW4CacheClearedReason@23@XZ
?RefreshLicense@LicensingService@@UEAA?AULicensingError@@XZ
?RefreshLicenseAsync@LicensingService@@UEAA?AV?$future@ULicensingError@@@std@@XZ
?RefreshSubscriptionData@LicensingService@@UEAA?AULicensingError@@XZ
?RefreshSubscriptionDataAsync@LicensingService@@UEAA?AV?$future@ULicensingError@@@std@@XZ
?ReturnLicense@LicensingService@@UEAA?AULicensingError@@XZ
?ReturnLicenseAsync@LicensingService@@UEAA?AV?$future@ULicensingError@@@std@@XZ
?SeatCountType@ObtainedLicenseEventArgs@Events@TSCLicensing@@QEBA?AW403@XZ
?SetActivationData@ObtainingLicenseEventArgs@Events@TSCLicensing@@QEAAXAEBVActivationData@3@@Z
?SetActivationListener@LicensingService@@UEAA?AULicensingError@@V?$duration@_JU?$ratio@$00$0DOI@@std@@@chrono@std@@V?$shared_ptr@VIActivationListener@@@5@@Z
?SetEntitlementListener@LicensingService@@UEAA?AULicensingError@@V?$duration@_JU?$ratio@$00$0DOI@@std@@@chrono@std@@V?$shared_ptr@VIEntitlementListener@@@5@@Z
?ShutDownEvents@EventSystem@Events@TSCLicensing@@UEAAXXZ
?ShutDownLibrary@LicensingService@@UEAA?AULicensingError@@XZ
?ShutDownLibraryAsync@LicensingService@@UEAA?AV?$future@ULicensingError@@@std@@XZ
?equals@BasicEventArgs@Events@TSCLicensing@@QEBA_NV123@@Z
?equals@ObtainedLicenseEventArgs@Events@TSCLicensing@@QEBA_NAEBV123@@Z

Sections

.text
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: - Virtual size: 3.7MB

.rdata Size: - Virtual size: 1.0MB

.data Size: - Virtual size: 126KB

.pdata Size: - Virtual size: 144KB

.vmp0 Size: - Virtual size: 1.3MB

.vmp1 Size: 4.6MB - Virtual size: 4.6MB

.reloc Size: 512B - Virtual size: 200B

.rsrc Size: 5KB - Virtual size: 4KB

.text
Size: - Virtual size: 3.7MB

.rdata
Size: - Virtual size: 1.0MB

.data
Size: - Virtual size: 126KB

.pdata
Size: - Virtual size: 144KB

.vmp0
Size: - Virtual size: 1.3MB

.vmp1
Size: 4.6MB - Virtual size: 4.6MB

.reloc
Size: 512B - Virtual size: 200B

.rsrc
Size: 5KB - Virtual size: 4KB