682bb8cca7cfb22dd0bd52167c57ac86

Sharing

Copy URL Twitter E-mail

General

Target

682bb8cca7cfb22dd0bd52167c57ac86
Size

60KB
MD5

682bb8cca7cfb22dd0bd52167c57ac86
SHA1

8b859941dcbdc88d9cf411cab6d7b0613ae7f175
SHA256

6fa9d441c21d34b0bea769cda35586ad6fa12a53eee48ff410e0e16f09407d9b
SHA512

01e5ff8a11787ea453da280ac3de69656f6ad06b542f830440653dc5d21f88e324c276b9417160f3c518a7a90cb26970c1fb6b0fe584ca867a4cf77a9dae4801
SSDEEP

1536:mDBfC488d9JthO56X91LuwsQEm+geS+I:mV7Vd9Jtw5C9ls0s

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
682bb8cca7cfb22dd0bd52167c57ac86

Files

682bb8cca7cfb22dd0bd52167c57ac86
.exe windows:4 windows x86 arch:x86

23baf0cdd3c85e0cabf399cc6e04d04b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFileA
GetSystemDirectoryA
OutputDebugStringA
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualFreeEx
WaitForSingleObject
CreateMutexA
LoadLibraryA
WriteProcessMemory
GetModuleFileNameA
VirtualAllocEx
OpenProcess
OpenMutexA
GetProcAddress
GetStartupInfoA
GetModuleHandleA
CreateRemoteThread
DeleteFileA
VirtualProtect
ExitProcess

user32

AppendMenuA
SendMessageA
GetSystemMenu
IsIconic
GetClientRect
DrawIcon
KillTimer
EnableWindow
LoadIconA
PostMessageA
FindWindowA
GetAsyncKeyState
SetTimer
MessageBoxA
GetSystemMetrics
PostQuitMessage

shell32

ShellExecuteA

mfc42

ord1949
ord823
ord4034
ord2135
ord1146
ord2379
ord2863
ord1168
ord389
ord5207
ord690
ord5953
ord4224
ord470
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord815
ord2514
ord6117
ord1134
ord3953
ord641
ord818
ord825
ord5265
ord4376
ord4853
ord4998
ord4710
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord4234
ord6055
ord1776
ord5290
ord3402
ord567
ord2302
ord800
ord4160
ord540
ord755
ord1576

msvcrt

??1type_info@@UAE@XZ
_onexit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
_ftol
sprintf
memcpy
_CxxThrowException
??0exception@@QAE@ABV0@@Z
memset
strrchr
strcat
strcpy
__CxxFrameHandler
_stricmp
_setmbcp
_exit

comctl32

InitCommonControlsEx

msvcp60

?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?eof@?$char_traits@D@std@@SAHXZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
?max@?$numeric_limits@H@std@@SAHXZ
?_Doraise@bad_cast@std@@MBEXXZ
?precision@ios_base@std@@QAEHH@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?fail@ios_base@std@@QBE_NXZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?unsetf@ios_base@std@@QAEXH@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??0bad_cast@std@@QAE@ABV01@@Z
??Bios_base@std@@QBEPAXXZ

d3dx9_37

D3DXCreateTextureFromFileInMemory
D3DXCreateFontA

Sections

.text
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23baf0cdd3c85e0cabf399cc6e04d04b

Headers

File Characteristics

Imports

kernel32

user32

shell32

mfc42

msvcrt

comctl32

msvcp60

d3dx9_37

Sections

.text Size: - Virtual size: 17KB

.rdata Size: - Virtual size: 6KB

.data Size: - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 14KB

.vmp0 Size: - Virtual size: 12KB

.vmp1 Size: 44KB - Virtual size: 43KB

.reloc Size: 4KB - Virtual size: 44B

.text
Size: - Virtual size: 17KB

.rdata
Size: - Virtual size: 6KB

.data
Size: - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 14KB

.vmp0
Size: - Virtual size: 12KB

.vmp1
Size: 44KB - Virtual size: 43KB

.reloc
Size: 4KB - Virtual size: 44B