adcca4dac6328e8dd6d86e3424f3dce5

Sharing

Copy URL Twitter E-mail

General

Target

adcca4dac6328e8dd6d86e3424f3dce5
Size

72KB
MD5

adcca4dac6328e8dd6d86e3424f3dce5
SHA1

0fa18ba790eee2d47df5591750034162a17bc3c3
SHA256

9d17013ef3191cd45bf45ff569a601ab429be603eb8f313351666e8082da4f51
SHA512

da1a7317e0d302855836a073c707d2999c3f4f1334413ffedb70b6cf3cdb9c69b2fb33577d8ae1c90178ba907fd626d947dac8740e07134564f262893bf38b20
SSDEEP

768:JftRqsocZqUV+Izm2yhSr3pNxGnSM/a9aThBQLnuwMl9YhQmik3xPSn089GV2ACq:FVdzXpNKa9aThBAE9Yhp1DoABiF7IH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adcca4dac6328e8dd6d86e3424f3dce5

Files

adcca4dac6328e8dd6d86e3424f3dce5
.dll windows:4 windows x86 arch:x86

eff6d1fadf96f1a57037f05d0fca7039

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord2915
ord2764
ord4129
ord6648
ord537
ord926
ord924
ord922
ord535
ord858
ord6663
ord860
ord4278
ord2818
ord1168
ord939
ord6877
ord800
ord540

msvcrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
malloc
time
__CxxFrameHandler
atoi
rand
free
strtok
exit
strstr
printf
srand

kernel32

Process32Next
GetTickCount
CreateThread
ExitThread
Sleep
lstrcmpiA
CloseHandle
GetVersionExA
GetComputerNameA
ExitProcess
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
CreateProcessA
GetProcAddress
LoadLibraryA
GetCurrentProcess
GetSystemDirectoryA
TerminateThread
CreateMutexA
GetLastError
lstrcpyA

user32

ExitWindowsEx
MessageBoxA
wsprintfA

advapi32

OpenProcessToken
LookupPrivilegeValueA
RegCloseKey
RegSetValueExA
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges

shell32

ShellExecuteA

ws2_32

gethostbyname
sendto
socket
htons
inet_addr
inet_ntoa
setsockopt
WSASocketA
WSAStartup
gethostname
htonl
connect
send
closesocket
recv
WSACleanup
WSAGetLastError
__WSAFDIsSet
select

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eff6d1fadf96f1a57037f05d0fca7039

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

shell32

ws2_32

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 888B

.vmp0 Size: 4KB - Virtual size: 2KB

.vmp1 Size: 20KB - Virtual size: 17KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 888B

.vmp0
Size: 4KB - Virtual size: 2KB

.vmp1
Size: 20KB - Virtual size: 17KB

.reloc
Size: 4KB - Virtual size: 2KB