7d48501423e66ff98b53b189416052dad18dab3ecdad6eb3f9122a37e4933f23

Sharing

Copy URL Twitter E-mail

General

Target

7d48501423e66ff98b53b189416052dad18dab3ecdad6eb3f9122a37e4933f23
Size

9.2MB
MD5

74d5111944e22cdf2e36be4197bbe5d5
SHA1

c0119ed1fbc2f66c9569b13ad32fa987eb00cbdc
SHA256

7d48501423e66ff98b53b189416052dad18dab3ecdad6eb3f9122a37e4933f23
SHA512

97fd50511689ecc4f20254eca19e48832b0484312ce1d727ce2d1954eeca234cfef34f03544be2fc031270e5b0db998c8e700047b5e64b1273efcfc7303aa3c1
SSDEEP

196608:D1+q/VbfDhHqRv46aM+NOVBwJTylhvSy:D1+IBtHqRgM+E2T0hvS

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d48501423e66ff98b53b189416052dad18dab3ecdad6eb3f9122a37e4933f23

Files

7d48501423e66ff98b53b189416052dad18dab3ecdad6eb3f9122a37e4933f23
.dll windows:6 windows x86

b14ec49d1a9812b97ca0574a32aca190

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

closesocket
connect
htons
inet_addr
recv
send
setsockopt
gethostbyname
WSAStartup
socket
inet_ntoa

kernel32

GetProcAddress
GetProcessHeap
FreeLibrary
IsBadReadPtr
TerminateProcess
InitializeCriticalSectionEx
HeapSize
GetLastError
HeapReAlloc
CloseHandle
RaiseException
DecodePointer
DeleteCriticalSection
HeapAlloc
GetModuleFileNameW
FindClose
GetFileAttributesW
DeleteFileW
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryW
CreateFileW
SetEndOfFile
SetFilePointer
WriteFile
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetFilePointerEx
GetNativeSystemInfo
LoadLibraryA
VirtualAlloc
VirtualFree
SetLastError
GetConsoleCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapFree
VirtualProtect
GetOEMCP
GetCommandLineA
WriteConsoleW
ReadConsoleW
GetConsoleMode
ReadFile
GetACP
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetModuleFileNameA
ExitProcess
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
GetCommandLineW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
VirtualQuery
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
GlobalFree
GetProcAddress
LocalAlloc
LocalFree
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle

user32

MessageBoxW
GetUserObjectInformationW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation

wininet

InternetCloseHandle
InternetOpenW
InternetConnectW
InternetReadFile
HttpOpenRequestA
HttpOpenRequestW
HttpAddRequestHeadersA
HttpSendRequestA
HttpSendRequestW
HttpQueryInfoA
InternetConnectA
HttpQueryInfoW

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpReceiveResponse
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpQueryHeaders
WinHttpSetOption

wtsapi32

WTSSendMessageW

Sections

.text
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b14ec49d1a9812b97ca0574a32aca190

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

wininet

winhttp

wtsapi32

Sections

.text Size: 184KB - Virtual size: 184KB

.rdata Size: 64KB - Virtual size: 64KB

.data Size: 8KB - Virtual size: 8KB

.vmp0 Size: 3.3MB - Virtual size: 3.3MB

.vmp1 Size: 5.6MB - Virtual size: 5.6MB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.l1 Size: 9KB - Virtual size: 9KB

.text
Size: 184KB - Virtual size: 184KB

.rdata
Size: 64KB - Virtual size: 64KB

.data
Size: 8KB - Virtual size: 8KB

.vmp0
Size: 3.3MB - Virtual size: 3.3MB

.vmp1
Size: 5.6MB - Virtual size: 5.6MB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.l1
Size: 9KB - Virtual size: 9KB