29b1dfbaea3edead71c02947f1c21b67

Sharing

Copy URL Twitter E-mail

General

Target

29b1dfbaea3edead71c02947f1c21b67
Size

1.2MB
MD5

29b1dfbaea3edead71c02947f1c21b67
SHA1

7e3e3b85e7825fac5d10b20f7afbd4aba8bc923a
SHA256

6af5fdb6267a86eec9dada1733c35f294c19f44ee186173522361de8d3d59b87
SHA512

9e18fe19552a0fa775c609eaab72a852a8487505628d73322147df415859e058d7c9b9f97ce51eb48cdbac7fdbb34ec94b3c6cdb1345476f79a6a98e8963206d
SSDEEP

24576:WtvZZ3Ljc6moHQYTDk5W2mHePW2uMynBbuA:SvH3LI6moHbDk5W2mHuyBbz

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29b1dfbaea3edead71c02947f1c21b67

Files

29b1dfbaea3edead71c02947f1c21b67
.exe windows:4 windows x86 arch:x86

c060cd334d468078bcf125f8f8d52b45

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RaiseException
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CopyAcceleratorTableA
MessageBoxA

gdi32

CreateRectRgn

winmm

midiStreamProperty

winspool.drv

ClosePrinter

advapi32

RegSetValueExA

shell32

Shell_NotifyIconA

ole32

StgCreateDocfileOnILockBytes

oleaut32

SysStringLen

comctl32

ImageList_Destroy

oledlg

ord8

ws2_32

accept

comdlg32

ChooseColorA

Sections

.text
Size: - Virtual size: 513KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 449KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c060cd334d468078bcf125f8f8d52b45

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

ws2_32

comdlg32

Sections

.text Size: - Virtual size: 513KB

.rdata Size: - Virtual size: 1.0MB

.data Size: - Virtual size: 198KB

.rsrc Size: 12KB - Virtual size: 23KB

.vmp0 Size: - Virtual size: 449KB

.vmp1 Size: 1.2MB - Virtual size: 1.2MB

.text
Size: - Virtual size: 513KB

.rdata
Size: - Virtual size: 1.0MB

.data
Size: - Virtual size: 198KB

.rsrc
Size: 12KB - Virtual size: 23KB

.vmp0
Size: - Virtual size: 449KB

.vmp1
Size: 1.2MB - Virtual size: 1.2MB