204263df369d00a4fcf969a7a74af72f

Sharing

Copy URL Twitter E-mail

General

Target

204263df369d00a4fcf969a7a74af72f
Size

56KB
MD5

204263df369d00a4fcf969a7a74af72f
SHA1

6c94aa7f36938b5bd9a91008c07c4bcc9ce5505d
SHA256

4a4464851bc08050c6c858c18a05f98178e5d09cd6133d4b9ef6df9f65a1c957
SHA512

ccd4975bf033cc25e0b20510e1fcb0e2f6bb77adf9e66aae58f731ad319a71a6b9eeefc4bd91987348f11acae8a3d5416ee92e954b3cae99cfade4e1d377aec4
SSDEEP

768:Zj4trhD7FarIaHRRu+goKhmEUHtm2wiAtW8LGS8MuVUE7F:4lDpAIoOONm2PAtW9UM

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
204263df369d00a4fcf969a7a74af72f

Files

204263df369d00a4fcf969a7a74af72f
.exe windows:4 windows x86 arch:x86

d9599b2ed74b5365946202aface03cce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord666
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaStrFixstr
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
DllFunctionCall
__vbaCastObjVar
_adj_fpatan
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord716
__vbaFPException
ord717
__vbaStrVarVal
__vbaVarCat
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaStrComp
__vbaStrToAnsi
__vbaVarDup
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr

kernel32

VirtualProtect
GetModuleFileNameA
ExitProcess

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d9599b2ed74b5365946202aface03cce

Headers

File Characteristics

Imports

msvbvm60

kernel32

user32

Sections

.text Size: - Virtual size: 20KB

.data Size: - Virtual size: 4KB

.rsrc Size: 12KB - Virtual size: 9KB

.vmp0 Size: - Virtual size: 8KB

.vmp1 Size: 36KB - Virtual size: 33KB

.reloc Size: 4KB - Virtual size: 80B

.text
Size: - Virtual size: 20KB

.data
Size: - Virtual size: 4KB

.rsrc
Size: 12KB - Virtual size: 9KB

.vmp0
Size: - Virtual size: 8KB

.vmp1
Size: 36KB - Virtual size: 33KB

.reloc
Size: 4KB - Virtual size: 80B