4cb6416424010878eddc7eceba6038d6055e8d144eff50eaa7aa0d3c1ef81f4d

Sharing

Copy URL Twitter E-mail

General

Target

4cb6416424010878eddc7eceba6038d6055e8d144eff50eaa7aa0d3c1ef81f4d
Size

1.4MB
MD5

cf83d3503f4783724a921114d624d524
SHA1

e7da9966e51e293279de9bf85fbe79aec617f4bb
SHA256

4cb6416424010878eddc7eceba6038d6055e8d144eff50eaa7aa0d3c1ef81f4d
SHA512

1e445c4c0672ba6a57acaed838e982d778ca178d430deb3b5fb314cfcb7d8106ee9213ecc67d10b88ea2f8f7a34f2380c47886e711124494527521c9e9efd5fc
SSDEEP

24576:GQHFJjIOy+9k6XdRGiWPT79noABiDcxgMQ2xD87y6Cm6bPfB3REpSRGyseSwvjvD:NUOym808RQ2xqfsrJ36pknseLbVHR

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4cb6416424010878eddc7eceba6038d6055e8d144eff50eaa7aa0d3c1ef81f4d

Files

4cb6416424010878eddc7eceba6038d6055e8d144eff50eaa7aa0d3c1ef81f4d
.dll windows:4 windows x86

4248820519c5bb21e5feb4f436d7ba85

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

EmptyClipboard
MessageBoxA

gdi32

CreateMetaFileA

comdlg32

PrintDlgA

winspool.drv

OpenPrinterA

advapi32

RegCloseKey

shell32

ExtractIconA

comctl32

ImageList_GetIcon

oledlg

ord3

ole32

CreateDataAdviseHolder

olepro32

ord253

oleaut32

VariantTimeToSystemTime

odbc32

ord4

Exports

Exports

GetInstallDetailsPayload
SignalChromeElf
SignalInitializeCrashReporting
StartAntiLsp

Sections

.text
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 951KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4248820519c5bb21e5feb4f436d7ba85

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

odbc32

Exports

Exports

Sections

.text Size: - Virtual size: 2.1MB

.rdata Size: - Virtual size: 156KB

.data Size: - Virtual size: 114KB

.idata Size: - Virtual size: 23KB

.rsrc Size: 8KB - Virtual size: 46KB

.vmp0 Size: - Virtual size: 89KB

.vmp1 Size: - Virtual size: 951KB

.vmp2 Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 4KB - Virtual size: 144B

.text
Size: - Virtual size: 2.1MB

.rdata
Size: - Virtual size: 156KB

.data
Size: - Virtual size: 114KB

.idata
Size: - Virtual size: 23KB

.rsrc
Size: 8KB - Virtual size: 46KB

.vmp0
Size: - Virtual size: 89KB

.vmp1
Size: - Virtual size: 951KB

.vmp2
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 4KB - Virtual size: 144B