57bc57e4629cde3d12fe02954d507f23e9191a19c60d31babf861f5a58cf2cfb

Sharing

Copy URL Twitter E-mail

General

Target

57bc57e4629cde3d12fe02954d507f23e9191a19c60d31babf861f5a58cf2cfb
Size

13.2MB
MD5

1de50e471e1e2d79606210959cc8fdb6
SHA1

128e3e1de1e1d144010c3b8531131d556c197876
SHA256

57bc57e4629cde3d12fe02954d507f23e9191a19c60d31babf861f5a58cf2cfb
SHA512

bcde5201c5cb02d2e48852a2f4086e230f15c92e9a3971ce75a42683c3a7b7ac77219cf722fccb2daddbdbe992254b341954bc6e29593347949825410834db83
SSDEEP

196608:thafc9kLJOvLaAOCJhAUlawSA8ites0YRXHiPsRxRS+G0fZO0XzzUdJhJnuEOdoX:fAC4JOvLBjtp1VDLCkD4j0Q73nu+rvz

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57bc57e4629cde3d12fe02954d507f23e9191a19c60d31babf861f5a58cf2cfb

Files

57bc57e4629cde3d12fe02954d507f23e9191a19c60d31babf861f5a58cf2cfb
.exe windows:5 windows x86

c0b5774679fa6e8500c08b3010a3f14c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsA

winmm

timeGetTime

ws2_32

select

kernel32

GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

RegisterClassExW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

gdi32

GetStockObject

advapi32

RegCreateKeyExA

ole32

CreateStreamOnHGlobal

wininet

InternetReadFile

gdiplus

GdipGetStringFormatFlags

imm32

ImmGetCompositionStringA

oledlg

ord8

oleaut32

SafeArrayGetDim

winspool.drv

DocumentPropertiesA

shell32

SHGetSpecialFolderPathA

comctl32

ord17

rasapi32

RasGetConnectStatusA

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 747KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 340KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 10.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 13.2MB - Virtual size: 13.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c0b5774679fa6e8500c08b3010a3f14c

Headers

File Characteristics

Imports

shlwapi

winmm

ws2_32

kernel32

user32

gdi32

advapi32

ole32

wininet

gdiplus

imm32

oledlg

oleaut32

winspool.drv

shell32

comctl32

rasapi32

wtsapi32

Sections

.text Size: - Virtual size: 747KB

.rdata Size: - Virtual size: 32KB

.data Size: - Virtual size: 340KB

.vmp0 Size: - Virtual size: 10.7MB

.vmp1 Size: 13.2MB - Virtual size: 13.2MB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: - Virtual size: 747KB

.rdata
Size: - Virtual size: 32KB

.data
Size: - Virtual size: 340KB

.vmp0
Size: - Virtual size: 10.7MB

.vmp1
Size: 13.2MB - Virtual size: 13.2MB

.rsrc
Size: 4KB - Virtual size: 1KB