6face94fa65d31686e649e8ddb75897eed17f67ea2f3121760f5c45e200ed686

Sharing

Copy URL Twitter E-mail

General

Target

6face94fa65d31686e649e8ddb75897eed17f67ea2f3121760f5c45e200ed686
Size

12.4MB
MD5

49c8f30217bfaa445fd5535fe29a5364
SHA1

e40f1544c63be2455803f020768fba9ed6d689e9
SHA256

6face94fa65d31686e649e8ddb75897eed17f67ea2f3121760f5c45e200ed686
SHA512

4b181633f7a31d3922798a1b0cd1fcc14b49f8d426bb688ba75b0874124d24ac8c686cd4252ec9184b8d231c5d62e9faebcd9ea92c0d7bdc9802017d2aef8130
SSDEEP

393216:mOe/75B5fL/qLPlyGscfoEYiJcaIK/Lh1J0g9+9:yVfLSZxs29sK/LTV9+9

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6face94fa65d31686e649e8ddb75897eed17f67ea2f3121760f5c45e200ed686

Files

6face94fa65d31686e649e8ddb75897eed17f67ea2f3121760f5c45e200ed686
.exe windows:6 windows x86

0d52990061a2024219ed15ac74eb167b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTimeAsFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
ResetEvent
CreateThread
SetEvent
Sleep
CreateEventW
SetThreadPriority
VirtualQuery
CopyFileW
WriteConsoleW
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
LCMapStringW
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
GetCurrentDirectoryW
GetSystemInfo
CloseHandle
DeleteFileW
GlobalFlags
GetFileAttributesExW
MultiByteToWideChar
GetSystemDirectoryW
GetVolumeInformationW
GetFileAttributesW
WaitForSingleObject
FindClose
GetModuleFileNameW
TerminateProcess
FindNextFileW
GetCommandLineW
SetLastError
FindFirstFileW
ReadFile
FreeLibrary
GetUserDefaultLCID
LockResource
FreeResource
GetCurrentThreadId
SizeofResource
GlobalReAlloc
MulDiv
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GlobalSize
IsDebuggerPresent
GetTickCount
CreateMutexW
OpenMutexW
ExitProcess
TryEnterCriticalSection
InitializeCriticalSection
GetCurrentProcess
GetProcAddress
LoadLibraryW
GetModuleHandleW
WideCharToMultiByte
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
SetFilePointerEx
GetStdHandle
GetFileType
SetStdHandle
QueryPerformanceFrequency
VirtualAlloc
HeapQueryInformation
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
GetCommandLineA
RtlUnwind
OutputDebugStringW
GetStartupInfoW
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
GetTempFileNameW
GetWindowsDirectoryW
SetErrorMode
GetFileTime
GetFileSizeEx
SystemTimeToTzSpecificLocalTime
GetProfileIntW
GetTempPathW
SearchPathW
RaiseException
HeapReAlloc
GetLastError
HeapSize
LeaveCriticalSection
lstrcmpiW
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetFullPathNameW
FlushFileBuffers
GetFileSize
CreateFileW
VerifyVersionInfoW
VerSetConditionMask
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LocalReAlloc
LocalAlloc
GlobalHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalGetAtomNameW
lstrcpyW
GetThreadLocale
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
ResumeThread
CompareStringA
lstrcmpA
GetCurrentThread
FormatMessageW
LocalFree
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryA
LoadLibraryExW
GetModuleHandleA
EncodePointer
OutputDebugStringA
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
HeapFree
GetVersionExW
GetCurrentProcess
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
GlobalFree
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
VirtualQuery
LocalFree
CreateFileA
ReadFile
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

user32

SetCursor
GetKeyState
SendMessageW
InvalidateRect
EnableWindow
EnumWindows
GetClassNameW
GetWindow
MessageBoxW
ReleaseDC
GetClientRect
GetWindowDC
GetSystemMetrics
GetDC
GetWindowRect
LoadImageW
GetParent
ShowWindow
GetWindowTextW
GetWindowThreadProcessId
wsprintfA
UnregisterClassW
AdjustWindowRectEx
GetDesktopWindow
GetMessagePos
InvertRect
ChildWindowFromPointEx
DestroyIcon
IsZoomed
SetRect
GetSystemMenu
CallWindowProcW
GetFocus
IsWindowVisible
SetWindowPos
SetWindowRgn
FillRect
ScreenToClient
MessageBeep
WindowFromPoint
GetScrollPos
RegisterWindowMessageW
DispatchMessageW
PeekMessageW
GetMessageTime
GetClassInfoExW
IsMenu
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgItem
GetMenuItemID
GetForegroundWindow
BeginPaint
EndPaint
ValidateRect
ScrollWindow
ShowScrollBar
GetWindowTextLengthW
MapWindowPoints
EqualRect
GetClassLongW
GetLastActivePopup
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetScrollInfo
GetScrollInfo
GetMenuStringW
GetMenuState
RemoveMenu
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
CheckDlgButton
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
SystemParametersInfoW
RegisterClipboardFormatW
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
GetMessageW
TranslateMessage
ShowOwnedPopups
CharNextW
CreateDialogIndirectParamW
EndDialog
DrawFocusRect
NotifyWinEvent
SendDlgItemMessageA
SetRectEmpty
GetMenuItemInfoW
InflateRect
MonitorFromPoint
GetSysColorBrush
RealChildWindowFromPoint
GetAsyncKeyState
BringWindowToTop
LoadAcceleratorsW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
SetLayeredWindowAttributes
EnumDisplayMonitors
DrawStateW
TrackMouseEvent
CharUpperW
PostThreadMessageW
WaitMessage
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CopyAcceleratorTableW
EnumChildWindows
LockWindowUpdate
SetClassLongW
InvalidateRgn
GetNextDlgGroupItem
DrawEdge
DrawFrameControl
DrawIconEx
UnionRect
GetIconInfo
SetCursorPos
CharUpperBuffW
UpdateLayeredWindow
EnableScrollBar
GetMenuDefaultItem
SetMenuDefaultItem
CopyIcon
FrameRect
IsClipboardFormatAvailable
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsCharLowerW
MapVirtualKeyExW
SubtractRect
GetUpdateRect
HideCaret
GetDoubleClickTime
DestroyCursor
GetComboBoxInfo
GetWindowRgn
DrawIcon
OffsetRect
GetCapture
RedrawWindow
GetScrollRange
CopyRect
GetDlgCtrlID
ClientToScreen
IsChild
GetTopWindow
GetSysColor
IsWindowEnabled
SetMenu
WinHelpW
LoadBitmapW
IsRectEmpty
IntersectRect
SetFocus
SetParent
SetCapture
SetScrollRange
SetWindowLongW
KillTimer
SetScrollPos
PtInRect
UpdateWindow
ReleaseCapture
IsIconic
GetNextDlgTabItem
IsWindow
wsprintfW
ModifyMenuW
GetMenu
GetMenuItemCount
DeleteMenu
CreatePopupMenu
TrackPopupMenu
GetSubMenu
DestroyAcceleratorTable
CreateAcceleratorTableW
DestroyMenu
TranslateAcceleratorW
InsertMenuW
CheckMenuItem
AppendMenuW
EnableMenuItem
CreateMenu
GetCursorPos
MonitorFromWindow
SetActiveWindow
OpenClipboard
GetMonitorInfoW
CloseClipboard
EmptyClipboard
MoveWindow
SetClipboardData
SetForegroundWindow
CopyImage
GetWindowLongW
DefWindowProcW
PostMessageW
DestroyWindow
GetPropW
CreateWindowExW
RemovePropW
GetActiveWindow
GetClassInfoW
SetTimer
RegisterClassW
SetPropW
LoadIconW
LoadCursorW
CharUpperBuffW
MessageBoxW

gdi32

SetPixelV
Polygon
LPtoDP
DPtoLP
GetWindowExtEx
SetPixel
CreateBrushIndirect
CreateHatchBrush
GetWindowOrgEx
CreatePatternBrush
GetPixel
CreateRectRgn
CreateBitmap
CombineRgn
GetViewportOrgEx
PatBlt
CreateRoundRectRgn
GetTextMetricsW
CreatePen
Rectangle
Ellipse
CreateSolidBrush
CreateEllipticRgn
CreateDCW
GetTextExtentPoint32W
BitBlt
CreateCompatibleBitmap
SelectObject
CreateDIBSection
SetDIBColorTable
GdiAlphaBlend
StretchBlt
RealizePalette
GetStockObject
GetDIBits
GetDeviceCaps
GetSystemPaletteEntries
SelectPalette
CreatePalette
GetObjectW
SetStretchBltMode
CreateFontIndirectW
DeleteObject
DeleteDC
SetBkColor
SetTextColor
CopyMetaFileW
Escape
SetMapMode
GetClipBox
GetObjectType
GetViewportExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
CreateCompatibleDC
SetBkMode
RoundRect
ExcludeClipRect
GetTextFaceW
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
SetPaletteEntries
ExtFloodFill
GetPaletteEntries
GetNearestPaletteIndex
EnumFontFamiliesExW
Polyline
CreatePolygonRgn
OffsetRgn
GetRgnBox
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
SetRectRgn
GetMapMode
GetTextColor
GetBkColor
CreateRectRgnIndirect
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
ExtSelectClipRgn

advapi32

RegDeleteValueW
RegEnumKeyW
RegEnumKeyExW
RegEnumValueW
RegDeleteKeyW
RegQueryValueExW
RegCloseKey
RegQueryValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW

shell32

ShellExecuteW
DragFinish
SHAppBarMessage
SHGetPathFromIDListW
Shell_NotifyIconW
DragQueryFileW
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetDesktopFolder
SHGetFileInfoW
SHGetMalloc

ole32

CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CoCreateGuid
CoDisconnectObject
CoGetClassObject
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoInitializeEx
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
DoDragDrop
OleGetClipboard
OleLockRunning
StgCreateDocfileOnILockBytes
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CLSIDFromProgID
CreateStreamOnHGlobal
CoUninitialize
OleRun
CLSIDFromString
OleCreateMenuDescriptor

oleaut32

SafeArrayDestroy
SysStringLen
SysAllocStringLen
SafeArrayGetUBound
VariantInit
SafeArrayGetDim
LHashValOfNameSys
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
LoadTypeLi
SafeArrayGetLBound
VariantCopyInd
SysFreeString
VariantClear
VariantChangeType
SafeArrayAccessData
VarCmp
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayGetElemsize
OleCreateFontIndirect
VariantCopy
SysAllocString
RegisterTypeLi

comctl32

ImageList_Create
ImageList_AddMasked
InitCommonControlsEx
ImageList_Destroy

msimg32

AlphaBlend
TransparentBlt

shlwapi

PathIsUNCW
PathStripToRootW
PathRemoveFileSpecW
StrFormatKBSizeW
PathFindFileNameW
PathFindExtensionW

uxtheme

GetWindowTheme
IsAppThemed
GetThemePartSize
DrawThemeBackground
CloseThemeData
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetCurrentThemeName
GetThemeColor
DrawThemeParentBackground
OpenThemeData
DrawThemeText

oledlg

OleUIBusyW

gdiplus

GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdiplusStartup
GdipGetImageHeight
GdipGetImagePaletteSize
GdipCreateFromHDC
GdipSetInterpolationMode
GdiplusShutdown
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImageWidth
GdipSetCompositingMode
GdipGetImagePalette
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCloneImage
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipAlloc
GdipDrawImageRectI
GdipDisposeImage
GdipGetImagePixelFormat
GdipFree
GdipBitmapLockBits

ws2_32

WSACleanup

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

wtsapi32

WTSSendMessageW

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 376KB - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.l1
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0d52990061a2024219ed15ac74eb167b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

msimg32

shlwapi

uxtheme

oledlg

gdiplus

ws2_32

oleacc

imm32

winmm

winspool.drv

wtsapi32

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 376KB - Virtual size: 376KB

.data Size: 48KB - Virtual size: 48KB

.vmp0 Size: 4.9MB - Virtual size: 4.9MB

.vmp1 Size: 5.2MB - Virtual size: 5.2MB

.reloc Size: 88KB - Virtual size: 88KB

.rsrc Size: 18KB - Virtual size: 18KB

.l1 Size: 29KB - Virtual size: 29KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 376KB - Virtual size: 376KB

.data
Size: 48KB - Virtual size: 48KB

.vmp0
Size: 4.9MB - Virtual size: 4.9MB

.vmp1
Size: 5.2MB - Virtual size: 5.2MB

.reloc
Size: 88KB - Virtual size: 88KB

.rsrc
Size: 18KB - Virtual size: 18KB

.l1
Size: 29KB - Virtual size: 29KB