346dc3faae2f17f64049938cd63c7914490311419467939197373db2daea351c

General

Target
346dc3faae2f17f64049938cd63c7914490311419467939197373db2daea351c
Size 5.1MB
Sample240201-bykllaaddk
SHA256 346dc3faae2f17f64049938cd63c7914490311419467939197373db2daea351c
MD5 22b7955929332a4d06ad1ded55e23a2e
SHA1 7eadef0d35d225a60bae1d43028638c9163389a4
SHA512 0ef02e0594d42b66db21766d1aaa22da29a35d0dd60399c53c3d3669551675a0f32bf0e91c123ced87b9fc92133833c5e90e59b1a46e3474b98033320851feb7
SSDEEP 98304:QHJGT7OyaNdZ0pmzKkinZREgMSw/nhmxfUB1eDpo87VFyYScNPgh1xLV:2oX2ZGR7EgLuh2E8po2zlNSHZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
346dc3faae2f17f64049938cd63c7914490311419467939197373db2daea351c

File Explorer

346dc3faae2f17f64049938cd63c7914490311419467939197373db2daea351c

.dll 5.1MB

346dc3faae2f17f64049938cd63c7914490311419467939197373db2daea351c

IMPHASH 9cd48424d3e6281abe3b140ec9172988
SHA256 346dc3faae2f17f64049938cd63c7914490311419467939197373db2daea351c
MD5 22b7955929332a4d06ad1ded55e23a2e
SHA1 7eadef0d35d225a60bae1d43028638c9163389a4
SHA512 0ef02e0594d42b66db21766d1aaa22da29a35d0dd60399c53c3d3669551675a0f32bf0e91c123ced87b9fc92133833c5e90e59b1a46e3474b98033320851feb7
SSDEEP 98304:QHJGT7OyaNdZ0pmzKkinZREgMSw/nhmxfUB1eDpo87VFyYScNPgh1xLV:2oX2ZGR7EgLuh2E8po2zlNSHZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4217388

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

346dc3faae2f17f64049938cd63c7914490311419467939197373db2daea351c

mfc140u

kernel32

user32

shlwapi

uxtheme

msvcp140

winmm

netapi32

version

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

wtsapi32

generic

Sharing

General

Malware Config

Signatures

File Explorer

346dc3faae2f17f64049938cd63c7914490311419467939197373db2daea351c

mfc140u

kernel32

user32

shlwapi

uxtheme

msvcp140

winmm

netapi32

version

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

wtsapi32

generic