24952000000001403388[.]exe[.]vir

Sharing

Copy URL Twitter E-mail

General

Target

24952000000001403388.exe.vir
Size

1.5MB
MD5

34bf4724f4fe481a6a5e1f220a2076f0
SHA1

85c77b4171be0359ce65d09b326b67d854eff9e0
SHA256

fa7a49bb1e836f7b49a0478fb8c52f329d892e5e9e5949f8b5124edb66b6c8a3
SHA512

dc5980e29bb47a3413107ee95dae8f853d0bd0771a5d73500a872971768165394464225721b0ae5c6cfaa9b17e560f996c6406e895354c41055476b446ef5c6f
SSDEEP

49152:kSTYEzwiA+g1FaQIXGmfQFahvVV7DM2kk8:k5+/A1obX0QvPDM2L8

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24952000000001403388.exe.vir

Files

24952000000001403388.exe.vir
.exe windows:6 windows x86 arch:x86

92a5e9b8496ab1719e838153cc29e80b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteProcessMemory
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SendMessageW

gdi32

CreateCompatibleDC

ole32

CoInitialize

oleaut32

VariantChangeType

comctl32

ImageList_Create

gdiplus

GdipCreateBitmapFromFile

ws2_32

WSACleanup

vcruntime140

_except_handler4_common

api-ms-win-crt-string-l1-1-0

wcsncmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 392KB - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

92a5e9b8496ab1719e838153cc29e80b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ole32

oleaut32

comctl32

gdiplus

ws2_32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 128KB

.rdata Size: 29KB - Virtual size: 28KB

.data Size: - Virtual size: 2KB

.vmp0 Size: - Virtual size: 2.9MB

.vmp1 Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 512B - Virtual size: 276B

.rsrc Size: 392KB - Virtual size: 392KB

.text
Size: - Virtual size: 128KB

.rdata
Size: 29KB - Virtual size: 28KB

.data
Size: - Virtual size: 2KB

.vmp0
Size: - Virtual size: 2.9MB

.vmp1
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 512B - Virtual size: 276B

.rsrc
Size: 392KB - Virtual size: 392KB