3a99a8b12aff2e8f33cf67ab0e2511c2

Sharing

Copy URL Twitter E-mail

General

Target

3a99a8b12aff2e8f33cf67ab0e2511c2
Size

84KB
MD5

3a99a8b12aff2e8f33cf67ab0e2511c2
SHA1

519fec86bfc401bd9bb6cbc29eb2496b64df853f
SHA256

3ccf0867afe2d4343e4187ebb085bf361c42cd2701e6e12c3fb602ee99c01ecd
SHA512

78f99a316bac03bd1e9ec867b0b95d6757071a1ce22ff35f99f6b76450aa42c7d9a9844a0f4ed100980b026c042f26b06a36bbf316c489126429d984e46bbe4a
SSDEEP

1536:nJ5pn821QuZ/xFF3/favuHJqFC9pteMfOw+FUY6SGUcwwcKcDrpqPzyox:nv+2euZx7avCqWTeGOFFUY45cKopqPGM

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a99a8b12aff2e8f33cf67ab0e2511c2

Files

3a99a8b12aff2e8f33cf67ab0e2511c2
.dll windows:4 windows x86 arch:x86

e3ec28bfeb183a578ed8f199109ed93b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord3953

msvcrt

_initterm

kernel32

LocalFree
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

MessageBoxA
MessageBoxA

advapi32

RegSetValueExA

Exports

Exports

RunPerl
cef_add_web_plugin_directory
cef_api_hash
cef_execute_process
cef_list_value_create
cef_process_message_create
cef_refresh_web_plugins
cef_string_list_alloc
cef_string_list_append
cef_string_list_copy
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf8_clear
cef_string_utf8_to_utf16
cef_v8context_get_current_context
cef_v8value_create_function
cef_v8value_create_object
cef_v8value_create_string

Sections

.text
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 750B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3ec28bfeb183a578ed8f199109ed93b

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: - Virtual size: 6KB

.rdata Size: - Virtual size: 2KB

.data Size: - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 2KB

.vmp0 Size: - Virtual size: 750B

.vmp1 Size: - Virtual size: 32KB

.vmp2 Size: 72KB - Virtual size: 68KB

.reloc Size: 4KB - Virtual size: 184B

.text
Size: - Virtual size: 6KB

.rdata
Size: - Virtual size: 2KB

.data
Size: - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 2KB

.vmp0
Size: - Virtual size: 750B

.vmp1
Size: - Virtual size: 32KB

.vmp2
Size: 72KB - Virtual size: 68KB

.reloc
Size: 4KB - Virtual size: 184B