d5db8b06cac5eb90df8553e159a30859db2ad56ac7e387e5b3e6cd90ef20ab31

Sharing

Copy URL Twitter E-mail

General

Target

d5db8b06cac5eb90df8553e159a30859db2ad56ac7e387e5b3e6cd90ef20ab31
Size

5.3MB
MD5

529fb60a37ee4f8041c188e15410b902
SHA1

8b8a00696c6b3a6fff05a5cc3e94309f493cc6ec
SHA256

d5db8b06cac5eb90df8553e159a30859db2ad56ac7e387e5b3e6cd90ef20ab31
SHA512

fae5090787f454f1635756bac7e6761a94ea1e5433feacc5645452a486ec5d141363c1740703d4df8b6595408de65d9a8c9b6364f91eeb45132f9d12e2a1ebe3
SSDEEP

98304:/QQ47yuI+NN0i3hDzSp0lPNRM0h4MgBMl4dq/+xiKQ7usuilEhZS4wVGbtXN4:MlNnDzEkNRMY4MgBMUm+uYc2tXy

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5db8b06cac5eb90df8553e159a30859db2ad56ac7e387e5b3e6cd90ef20ab31

Files

d5db8b06cac5eb90df8553e159a30859db2ad56ac7e387e5b3e6cd90ef20ab31
.dll windows:5 windows x64

8f15a02bb0e33ba1c2625b37e64f2109

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GetCurrentProcessId
QueryPerformanceCounter
QueryPerformanceFrequency
OutputDebugStringA
ReleaseSemaphore
Sleep
GetLastError
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
CreateSemaphoreA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateFileW
CreateFileA
GetCurrentProcess
GetProcAddress
FreeLibrary
LoadLibraryW
TerminateThread
WaitForSingleObject
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTimes
Process32NextW
OpenProcess
Process32FirstW
ProcessIdToSessionId
lstrlenW
SetEndOfFile
LocalFree
lstrlenA
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
DeviceIoControl
HeapReAlloc
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
SetFilePointer
ReadFile
GetConsoleMode
GetConsoleCP
GetStartupInfoW
GetFileType
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStringTypeW
CreateProcessA
GetSystemDefaultLangID
LCMapStringW
HeapDestroy
HeapCreate
GlobalFree
HeapSetInformation
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
HeapSize
FlsAlloc
SetLastError
FlsFree
FlsGetValue
RtlCaptureContext
RtlVirtualUnwind
GetProcessHeap
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
FlsSetValue
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
DecodePointer
GetModuleHandleA
GetModuleFileNameA
TerminateProcess
GetUserDefaultLCID
CloseHandle
EncodePointer
RtlPcToFileHeader
RaiseException
RtlUnwindEx
RtlLookupFunctionEntry
GetVersionExA
GetVersion

user32

SetDlgItemTextW
SendMessageW
GetWindowRect
wsprintfA
SetWindowPos
SetWindowLongW
GetWindowLongW
GetParent
SetWindowLongPtrW
CallWindowProcW
EndDialog

shell32

ShellExecuteExA

ole32

CoInitializeEx
CoSetProxyBlanket
IIDFromString
StringFromCLSID
CoUninitialize
CoTaskMemFree
CoCreateInstance

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

advapi32

OpenProcessToken

wininet

InternetCrackUrlA
InternetGetConnectedState
InternetOpenA
InternetConnectA
InternetCloseHandle
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoW
InternetReadFile

ws2_32

htonl
gethostbyname
ntohl
inet_addr
htons
ntohs
recv
send
socket
ioctlsocket
WSACleanup
gethostname
WSAStartup
WSAGetLastError
closesocket
getsockopt
connect
select

shlwapi

PathFileExistsA

iphlpapi

GetAdaptersAddresses
GetIpNetTable
GetAdaptersInfo
GetExtendedTcpTable

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

winmm

timeGetTime

wtsapi32

WTSFreeMemory
WTSEnumerateSessionsA

psapi

GetModuleFileNameExW

Exports

Exports

QueryPluginInterface

Sections

.text
Size: 404KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8f15a02bb0e33ba1c2625b37e64f2109

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

advapi32

wininet

ws2_32

shlwapi

iphlpapi

setupapi

winmm

wtsapi32

psapi

Exports

Exports

Sections

.text Size: 404KB - Virtual size: 404KB

.rdata Size: 104KB - Virtual size: 104KB

.data Size: 24KB - Virtual size: 24KB

.pdata Size: 24KB - Virtual size: 24KB

.vmp0 Size: 1.5MB - Virtual size: 1.5MB

.vmp1 Size: 3.2MB - Virtual size: 3.2MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.l1 Size: 9KB - Virtual size: 9KB

.text
Size: 404KB - Virtual size: 404KB

.rdata
Size: 104KB - Virtual size: 104KB

.data
Size: 24KB - Virtual size: 24KB

.pdata
Size: 24KB - Virtual size: 24KB

.vmp0
Size: 1.5MB - Virtual size: 1.5MB

.vmp1
Size: 3.2MB - Virtual size: 3.2MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.l1
Size: 9KB - Virtual size: 9KB