11d3e2eb6db766f759c6c0ee516f4104

Sharing

Copy URL Twitter E-mail

General

Target

11d3e2eb6db766f759c6c0ee516f4104
Size

5.9MB
MD5

11d3e2eb6db766f759c6c0ee516f4104
SHA1

5247cb9b80ae808b9cacbaeea903f08b4a3632f6
SHA256

a636baefa9d2b4fb40d53fc41979cd054f698124edf7fbfdf962388c3da346d1
SHA512

b5819a010c6300b768ee9934967f51a00af5eb8ac9bb06efa3aac8842b8afac99a9f453a051c5e01f6be2565da375725e498d6e51e50f77332ff015f1e36e608
SSDEEP

98304:2jDb+IRX1aTaAjnq1zbyCEipsKfYzGgYmTQCxeU/Aufz7eps/bP9yw/6nY04i:APPRkOiyOCo6YOmTzxepS3epOP5/p04i

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11d3e2eb6db766f759c6c0ee516f4104

Files

11d3e2eb6db766f759c6c0ee516f4104
.exe windows:6 windows x64 arch:x64

1abdcae28c5834b62b91e1b8a029929c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptReleaseContext

kernel32

Sleep
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

MessageBoxA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

winhttp

WinHttpQueryDataAvailable

d3d9

Direct3DCreate9Ex

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 828KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.9MB - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1abdcae28c5834b62b91e1b8a029929c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

winhttp

d3d9

d3dx9_43

dwmapi

imm32

wtsapi32

Sections

.text Size: - Virtual size: 828KB

.rdata Size: - Virtual size: 321KB

.data Size: - Virtual size: 263KB

.pdata Size: - Virtual size: 28KB

_RDATA Size: - Virtual size: 244B

.vmp0 Size: - Virtual size: 3.4MB

.vmp1 Size: 5.9MB - Virtual size: 5.9MB

.reloc Size: 512B - Virtual size: 208B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 828KB

.rdata
Size: - Virtual size: 321KB

.data
Size: - Virtual size: 263KB

.pdata
Size: - Virtual size: 28KB

_RDATA
Size: - Virtual size: 244B

.vmp0
Size: - Virtual size: 3.4MB

.vmp1
Size: 5.9MB - Virtual size: 5.9MB

.reloc
Size: 512B - Virtual size: 208B

.rsrc
Size: 512B - Virtual size: 480B