988696e7bd2d3103c7e561f86f131a7a

Sharing

Copy URL Twitter E-mail

General

Target

988696e7bd2d3103c7e561f86f131a7a
Size

42KB
MD5

988696e7bd2d3103c7e561f86f131a7a
SHA1

b835759c6b3583a224f9b183a9fde81cde32d5ed
SHA256

8bfc113216f212128cf2b3ef6318937bdb1211e9b6706826df3acf675e4cf00e
SHA512

ca7bff198ddd454b3ec831b2ee1805101123d3784aca8896bf04143f053afbd9ae9cf82bc7c4577c3c03a6e9060494bc32d930fde651731fe627b626f28be819
SSDEEP

192:wmuQSsm3mca9rUokqw4mZhPD19zHJU+rySYsIuMeNDKNN6Uns14co/fjvCjXLp7g:w9ZmN150hPZVrySpoeNuxG3VLpV6

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
988696e7bd2d3103c7e561f86f131a7a

Files

988696e7bd2d3103c7e561f86f131a7a
.dll windows:4 windows x86 arch:x86

22d25d9797429b2882b194856313951e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
CloseHandle
WriteFile
CreateFileA
lstrcmpiA
GetModuleFileNameA
DisableThreadLibraryCalls
CreateThread
SetFileTime
GetFileTime
GetEnvironmentVariableA
Sleep
DeleteFileA
FreeLibraryAndExitThread
ExitProcess
WaitForSingleObject
GetProcAddress
lstrcmpA
ReadFile
SetFilePointer
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
CreateProcessA
GetSystemDirectoryA
GetStartupInfoA
VirtualFreeEx
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
lstrlenW
MultiByteToWideChar
GetCurrentProcess
lstrcpyA
FreeLibrary
CreateEventA
LoadLibraryA

user32

wsprintfA
WaitForInputIdle

advapi32

AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

wininet

InternetOpenA
HttpQueryInfoA
InternetReadFile
InternetSetOptionA
InternetCloseHandle
InternetOpenUrlA

msvcrt

??2@YAPAXI@Z
_adjust_fdiv
malloc
_initterm
free
_except_handler3
memcpy
strchr
memset
??3@YAXPAX@Z
__CxxFrameHandler
_EH_prolog

Exports

Exports

DoWorkEx
DoWorkWl

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 4KB - Virtual size: 678B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

22d25d9797429b2882b194856313951e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wininet

msvcrt

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 4KB

Shared Size: 4KB - Virtual size: 4B

.vmp0 Size: 4KB - Virtual size: 678B

.vmp1 Size: 8KB - Virtual size: 5KB

.reloc Size: 4KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

Shared
Size: 4KB - Virtual size: 4B

.vmp0
Size: 4KB - Virtual size: 678B

.vmp1
Size: 8KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 1KB