accc7673ebf4d9469adba148444c1c476c607e0c5c6615e93684e6b3c6d76d7c

Sharing

Copy URL Twitter E-mail

General

Target

accc7673ebf4d9469adba148444c1c476c607e0c5c6615e93684e6b3c6d76d7c
Size

5.6MB
MD5

dc69130bcf123e3eb2bb2c893f32603f
SHA1

1170eb1b45c390ca7d2a49f2cadb98fc9caa9060
SHA256

accc7673ebf4d9469adba148444c1c476c607e0c5c6615e93684e6b3c6d76d7c
SHA512

3491a10a319dda2245d345896409ba14b793f18fbe691dc9749001491d6bf6aa1ef324a0a43c0b1e327410fed738b933ad840f9900da8301c157d4004991ff6b
SSDEEP

98304:El6d4y6q/JWITwsk77e2RyVEP4qQ0Y8Rkt34SKSFAEybfyPRDzfnQGID2:ldAq/JWITpf+yVK9YJ3tAsP1LID

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
accc7673ebf4d9469adba148444c1c476c607e0c5c6615e93684e6b3c6d76d7c

Files

accc7673ebf4d9469adba148444c1c476c607e0c5c6615e93684e6b3c6d76d7c
.exe windows:6 windows x86

003fdeafb641cef79360a60c5ee35d93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc140u

ord14669

kernel32

CloseHandle
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

PeekMessageW
CharUpperBuffW

gdi32

GetBkColor

advapi32

InitiateSystemShutdownExW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

oleaut32

VariantClear

msvcp140

?_Xbad_alloc@std@@YAXXZ

sacrazy

ord7

ws2_32

send

salogin

SS_DecryptImageCode

wininet

HttpAddRequestHeadersW

vcruntime140

_CxxThrowException

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-convert-l1-1-0

_wtof

api-ms-win-crt-stdio-l1-1-0

_get_osfhandle

api-ms-win-crt-time-l1-1-0

_mktime64

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-filesystem-l1-1-0

rename

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

floor

api-ms-win-crt-environment-l1-1-0

getenv

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 45.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

003fdeafb641cef79360a60c5ee35d93

Headers

DLL Characteristics

File Characteristics

Imports

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

oleaut32

msvcp140

sacrazy

ws2_32

salogin

wininet

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

wtsapi32

Sections

.text Size: - Virtual size: 2.1MB

.rdata Size: - Virtual size: 278KB

.data Size: - Virtual size: 45.1MB

.tls Size: 512B - Virtual size: 9B

.vmp0 Size: - Virtual size: 5.8MB

.vmp1 Size: 5.6MB - Virtual size: 5.6MB

.reloc Size: 512B - Virtual size: 284B

.rsrc Size: 73KB - Virtual size: 73KB

.text
Size: - Virtual size: 2.1MB

.rdata
Size: - Virtual size: 278KB

.data
Size: - Virtual size: 45.1MB

.tls
Size: 512B - Virtual size: 9B

.vmp0
Size: - Virtual size: 5.8MB

.vmp1
Size: 5.6MB - Virtual size: 5.6MB

.reloc
Size: 512B - Virtual size: 284B

.rsrc
Size: 73KB - Virtual size: 73KB