b2761b547e6440e4ab1a1a708acbf8eb977e4b8328e8aea68c458083a8c20b75

Sharing

Copy URL Twitter E-mail

General

Target

b2761b547e6440e4ab1a1a708acbf8eb977e4b8328e8aea68c458083a8c20b75
Size

5.6MB
MD5

1406196ea653b1d9e179c922b13eeb11
SHA1

0b00fde0d4bf7f951c23ec0c29f2acf5cafe3553
SHA256

b2761b547e6440e4ab1a1a708acbf8eb977e4b8328e8aea68c458083a8c20b75
SHA512

6f8498316ecb871d1cb8a344ada79842c11583eb11653519267f9d39646e8dce3b5380de24a76bdc94d5249b542e1904a38a8205d5652797035018cee7cc29c1
SSDEEP

98304:b05qhuURNNdh9NzrAo2AHIDkAiOsEukBIQz/bFBCzzXYQkIXO8NBpX8Xgw0Nr:FJRVhboo25D3JjBIQjbFBCnXYQkIBjZN

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2761b547e6440e4ab1a1a708acbf8eb977e4b8328e8aea68c458083a8c20b75

Files

b2761b547e6440e4ab1a1a708acbf8eb977e4b8328e8aea68c458083a8c20b75
.exe windows:6 windows x86

4b82836315129d78e2274965bc42714a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc140u

ord6348

kernel32

GetCurrentProcess
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

PeekMessageW
CharUpperBuffW

gdi32

GetBkColor

advapi32

InitiateSystemShutdownExW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

oleaut32

VariantClear

msvcp140

?_Xbad_alloc@std@@YAXXZ

sacrazy

ord7

ws2_32

send

salogin

SS_DecryptImageCode

netapi32

Netbios

wininet

InternetCloseHandle

vcruntime140

_CxxThrowException

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-convert-l1-1-0

_wtof

api-ms-win-crt-stdio-l1-1-0

_get_osfhandle

api-ms-win-crt-time-l1-1-0

_mktime64

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-filesystem-l1-1-0

rename

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

floor

api-ms-win-crt-environment-l1-1-0

getenv

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 45.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4b82836315129d78e2274965bc42714a

Headers

DLL Characteristics

File Characteristics

Imports

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

oleaut32

msvcp140

sacrazy

ws2_32

salogin

netapi32

wininet

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

wtsapi32

Sections

.text Size: - Virtual size: 2.2MB

.rdata Size: - Virtual size: 279KB

.data Size: - Virtual size: 45.1MB

.tls Size: 512B - Virtual size: 9B

.vmp0 Size: - Virtual size: 5.8MB

.vmp1 Size: 5.6MB - Virtual size: 5.6MB

.reloc Size: 512B - Virtual size: 304B

.rsrc Size: 73KB - Virtual size: 73KB

.text
Size: - Virtual size: 2.2MB

.rdata
Size: - Virtual size: 279KB

.data
Size: - Virtual size: 45.1MB

.tls
Size: 512B - Virtual size: 9B

.vmp0
Size: - Virtual size: 5.8MB

.vmp1
Size: 5.6MB - Virtual size: 5.6MB

.reloc
Size: 512B - Virtual size: 304B

.rsrc
Size: 73KB - Virtual size: 73KB