84dfe3e2c2c23431bf1016ea20d6c329

Sharing

Copy URL Twitter E-mail

General

Target

84dfe3e2c2c23431bf1016ea20d6c329
Size

5.4MB
MD5

84dfe3e2c2c23431bf1016ea20d6c329
SHA1

a550c42c27139a7b6342edefed46646847ef0e90
SHA256

3b0cf0a25f13296540bfcc2e891958adc7c8c7aa799cf4cc1988d79299f6c1c4
SHA512

6a08f161325481c5ef1242ab3707935cdb24f54ec0b992a1a5fb459bea1be49ab68f949b578f39c3c5b61b0c834f03e82477171a1aec2a02a86bb3839825fac4
SSDEEP

98304:UFKcieVSvNTwVaUSCBsZgw2PJ2Q9tv9aiayBgfBY1CXpmzL7J/C7dep4mh:UDObUSCZwmJ2Ud9paICOkobUep4W

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84dfe3e2c2c23431bf1016ea20d6c329

Files

84dfe3e2c2c23431bf1016ea20d6c329
.exe windows:6 windows x64 arch:x64

c00b5b4d2620c93a52ed55d2462197db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DeviceIoControl
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

SetWindowsHookExA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

ntdll

RtlCaptureContext

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 281KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c00b5b4d2620c93a52ed55d2462197db

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ntdll

wtsapi32

Sections

.text Size: - Virtual size: 171KB

.rdata Size: - Virtual size: 77KB

.data Size: - Virtual size: 281KB

.pdata Size: - Virtual size: 8KB

_RDATA Size: - Virtual size: 244B

.vmp0 Size: - Virtual size: 3.3MB

.vmp1 Size: 5.4MB - Virtual size: 5.4MB

.reloc Size: 512B - Virtual size: 196B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 171KB

.rdata
Size: - Virtual size: 77KB

.data
Size: - Virtual size: 281KB

.pdata
Size: - Virtual size: 8KB

_RDATA
Size: - Virtual size: 244B

.vmp0
Size: - Virtual size: 3.3MB

.vmp1
Size: 5.4MB - Virtual size: 5.4MB

.reloc
Size: 512B - Virtual size: 196B

.rsrc
Size: 512B - Virtual size: 480B