64bc3dae4cf15da8925fde7a746a3ef1

Sharing

Copy URL

Twitter E-mail

General

Target

64bc3dae4cf15da8925fde7a746a3ef1
Size

660KB
MD5

64bc3dae4cf15da8925fde7a746a3ef1
SHA1

b989dba6696532fc7442ac3503cc3b041f894664
SHA256

e5d19689742cc9c9e092874cb6059217ca2fac7ddd09fb116d3bd135e21b17ae
SHA512

b0a5f10285ad8ea3b10c9acf7c54e4544609c0dceb7ecc627d4b510396f08c1249394dfb0e8d41f1c6903c6d4ba5cef57e3c998442ea0f756564cdd3baf140bb
SSDEEP

12288:Ylle1TzT0vLXAYgDb6I2/l8+QOodK2kQhjVPGDAeMhTWQf:YlO0UA/l8gMMQhZGDAeox

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64bc3dae4cf15da8925fde7a746a3ef1

Files

64bc3dae4cf15da8925fde7a746a3ef1
.dll windows:4 windows x86 arch:x86

a47085440157826cc74b28d19f40ce48

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

IsBadCodePtr
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

OpenClipboard
MessageBoxA

gdi32

CreateRectRgnIndirect

winmm

waveOutReset

winspool.drv

ClosePrinter

advapi32

RegCreateKeyExA

shell32

Shell_NotifyIconA

ole32

OleUninitialize

oleaut32

RegisterTypeLi

comctl32

ImageList_Destroy

ws2_32

ioctlsocket

comdlg32

GetFileTitleA

Exports

Exports

RunDllHostCallBack

Sections

.text
Size: - Virtual size: 459KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 644KB - Virtual size: 641KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a47085440157826cc74b28d19f40ce48

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

Exports

Exports

Sections

.text Size: - Virtual size: 459KB

.rdata Size: - Virtual size: 75KB

.data Size: - Virtual size: 181KB

.rsrc Size: 8KB - Virtual size: 21KB

.vmp0 Size: - Virtual size: 67KB

.vmp1 Size: - Virtual size: 316KB

.vmp2 Size: 644KB - Virtual size: 641KB

.reloc Size: 4KB - Virtual size: 224B

.text
Size: - Virtual size: 459KB

.rdata
Size: - Virtual size: 75KB

.data
Size: - Virtual size: 181KB

.rsrc
Size: 8KB - Virtual size: 21KB

.vmp0
Size: - Virtual size: 67KB

.vmp1
Size: - Virtual size: 316KB

.vmp2
Size: 644KB - Virtual size: 641KB

.reloc
Size: 4KB - Virtual size: 224B