74c7ff479f11ac1ab28775187d5a3b6c

Sharing

Copy URL

Twitter E-mail

General

Target

74c7ff479f11ac1ab28775187d5a3b6c
Size

74KB
MD5

74c7ff479f11ac1ab28775187d5a3b6c
SHA1

cb1a83811aac9184f045e94861e3e71699313116
SHA256

736204f708aad709a9f267bb63674b7dc434026e2d6f49b7c174fc5abb06a1bb
SHA512

db03abbce7551b2c3706b884a20cade3f4bf5fd0926a8e68b2f96369f82292783bffdc75f1986026971adc74ab2883a32e2855c25697f7dcf3852b11024e0ba4
SSDEEP

1536:H+jvejPejRK16Rr/+IqcveFWrIUFpxaAkbilfl3:Oe4RK1ICIqcveFWrjb9kb6d

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
74c7ff479f11ac1ab28775187d5a3b6c

Files

74c7ff479f11ac1ab28775187d5a3b6c
.dll windows:4 windows x86 arch:x86

b829a3a9cadd83424a3646a377884cab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA
CreateFileA
ReadFile
GetFileSize
CloseHandle
GetTempPathA
DeleteFileA
MultiByteToWideChar
GlobalAlloc
GlobalLock
WriteFile
GlobalUnlock
GlobalFree
CreateToolhelp32Snapshot
GetTickCount
Process32Next
VirtualAlloc
GetModuleHandleA
GetPrivateProfileStringA
CreateThread
WideCharToMultiByte
GetSystemTime
WritePrivateProfileStringA
IsBadReadPtr
SetFilePointer
GetModuleFileNameA
GetCurrentProcessId
CreateMutexA
GetLastError
lstrcmpiA
lstrlenA
ExitProcess
lstrcmpA
Sleep
VirtualProtect
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcatA
GetSystemDirectoryA
Process32First
OutputDebugStringA

user32

ReleaseDC
IsRectEmpty
GetDC
GetSystemMetrics
GetWindowTextA
IsWindowVisible
IsIconic
GetActiveWindow
ShowWindow
SetForegroundWindow
FindWindowA
FindWindowExA
GetWindowThreadProcessId
GetWindowInfo
PrintWindow
EnumWindows

gdi32

BitBlt
DeleteObject
GetObjectA
CreateDCA
GetDeviceCaps
DeleteDC
GetStockObject
SelectPalette
RealizePalette
GetDIBits
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject

ws2_32

shutdown
inet_ntoa
gethostbyname

gdiplus

GdipCloneImage
GdipLoadImageFromFile
GdipGetImageEncodersSize
GdipDisposeImage
GdipAlloc
GdipFree
GdipGetImageEncoders
GdiplusStartup
GdiplusShutdown
GdipSaveImageToFile

wininet

InternetConnectA
HttpOpenRequestA
InternetOpenA
HttpSendRequestExA
HttpEndRequestA
InternetCloseHandle
HttpAddRequestHeadersA

msvcrt

_local_unwind2
??3@YAXPAX@Z
atoi
malloc
free
memmove
strrchr
strstr
sprintf
??1type_info@@UAE@XZ
memcpy
memset
_except_handler3
??2@YAPAXI@Z

shlwapi

StrChrW

Exports

Exports

DeleteSelf

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b829a3a9cadd83424a3646a377884cab

Headers

File Characteristics

Imports

kernel32

user32

gdi32

ws2_32

gdiplus

wininet

msvcrt

shlwapi

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 17KB

.vmp0 Size: 4KB - Virtual size: 2KB

.vmp1 Size: 16KB - Virtual size: 12KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 17KB

.vmp0
Size: 4KB - Virtual size: 2KB

.vmp1
Size: 16KB - Virtual size: 12KB

.reloc
Size: 4KB - Virtual size: 2KB