4c48ac64c2f46073b972badebf38f43f

Sharing

Copy URL Twitter E-mail

General

Target

4c48ac64c2f46073b972badebf38f43f
Size

88KB
MD5

4c48ac64c2f46073b972badebf38f43f
SHA1

4673b9c28d6c5fbbb264731f1aa2e45a8bfaffa5
SHA256

70131997aba5d518cfbae493b147d6f4bdfc010d8a6eb1cc51c65250a7b3c810
SHA512

57bcffd95627508b5b99d8589641b000e7ea641e3e42ff42fb38b7a176076b9c978317ed2b21204039026b0cb9679b61efaeabe06091362b9cb81daf08ebbdd7
SSDEEP

1536:m0qnD43mdJwKnjRaU/pt5Gb0FY3XyODziVL3LfoXr84UZ:eD2mdJwKnjRaUj5GZyOcLboXw4UZ

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c48ac64c2f46073b972badebf38f43f

Files

4c48ac64c2f46073b972badebf38f43f
.dll windows:4 windows x86 arch:x86

04d01e6863f50e645b6f09e786249f77

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathFileExistsA

psapi

EnumProcessModules
GetModuleFileNameExA

mfc42

ord5186
ord350
ord354
ord5442
ord2915
ord858
ord922
ord6778
ord5710
ord5683
ord1253
ord342
ord924
ord4129
ord1182
ord6385
ord1979
ord665
ord3663
ord3616
ord3127
ord5651
ord540
ord1168
ord823
ord535
ord940
ord825
ord860
ord800
ord537
ord941

msvcrt

_adjust_fdiv
malloc
_initterm
free
?terminate@@YAXXZ
_except_handler3
_onexit
_mbsicmp
fclose
time
srand
rand
__CxxFrameHandler
__dllonexit

kernel32

CloseHandle
GetModuleFileNameA
Process32First
CreateToolhelp32Snapshot
OpenProcess
CreateProcessA
CopyFileA
DeleteFileA
Sleep
WaitForSingleObject
CreateThread
CreateFileA
TerminateProcess
CreateDirectoryA
GetTempPathA
GetWindowsDirectoryA
Process32Next

advapi32

SetSecurityDescriptorDacl
SetFileSecurityA
InitializeSecurityDescriptor

shell32

SHGetSpecialFolderPathA

msvcp60

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z
??1ios_base@std@@UAE@XZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@ios_base@std@@QAEXH_N@Z
??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@
?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
??_7?$basic_fstream@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??0ios_base@std@@IAE@XZ
??_8?$basic_fstream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
??_8?$basic_fstream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@

Exports

Exports

ChangeHash
StartProcess

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 4KB - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

04d01e6863f50e645b6f09e786249f77

Headers

File Characteristics

Imports

shlwapi

psapi

mfc42

msvcrt

kernel32

advapi32

shell32

msvcp60

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 620B

.rsrc Size: 4KB - Virtual size: 888B

.vmp0 Size: 4KB - Virtual size: 876B

.vmp1 Size: 56KB - Virtual size: 55KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 620B

.rsrc
Size: 4KB - Virtual size: 888B

.vmp0
Size: 4KB - Virtual size: 876B

.vmp1
Size: 56KB - Virtual size: 55KB

.reloc
Size: 4KB - Virtual size: 1KB