bde0d4e670252d91b200a2d58ff1966d

Sharing

Copy URL Twitter E-mail

General

Target

bde0d4e670252d91b200a2d58ff1966d
Size

6.4MB
MD5

bde0d4e670252d91b200a2d58ff1966d
SHA1

6561f3962f1f6b3165037c4fc8509059f50b6433
SHA256

8dc8f8e72dcd1fc7380d6cb8d6c1533b34788094227e4553ae83b0493a7ea963
SHA512

b8c87d5c7452dc37a1d5cdf6053256596741f84e7ef3e731f17fbb8898d820a05fe453e648ed837f81411f849caa2d2147f48a90516743d2b418d99c177f2c0b
SSDEEP

196608:L+fgehCX+0iwUq+fkhYJYpRhEOz2YpLIc/caypRZ:Lde++TwUqnRpoO6YRIEypRZ

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bde0d4e670252d91b200a2d58ff1966d

Files

bde0d4e670252d91b200a2d58ff1966d
.exe windows:6 windows x64 arch:x64

ae5fbcfef1caf8260af75541ee284086

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

TerminateProcess
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

RegisterClassExA
CharUpperBuffW

msvcp140

_Mtx_unlock

imm32

ImmGetContext

d3dcompiler_47

D3DCompile

xinput1_4

ord2

vcruntime140

_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_wfopen

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-convert-l1-1-0

strtof

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-string-l1-1-0

strncpy

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

acosf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

wtsapi32

WTSSendMessageW

advapi32

RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

Sections

.text
Size: - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 11.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae5fbcfef1caf8260af75541ee284086

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

kernel32

user32

msvcp140

imm32

d3dcompiler_47

xinput1_4

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

wtsapi32

advapi32

Sections

.text Size: - Virtual size: 260KB

.rdata Size: 61KB - Virtual size: 60KB

.data Size: - Virtual size: 6KB

.pdata Size: - Virtual size: 10KB

.vmp0 Size: - Virtual size: 11.5MB

.vmp1 Size: 6.3MB - Virtual size: 6.3MB

.reloc Size: 512B - Virtual size: 232B

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 260KB

.rdata
Size: 61KB - Virtual size: 60KB

.data
Size: - Virtual size: 6KB

.pdata
Size: - Virtual size: 10KB

.vmp0
Size: - Virtual size: 11.5MB

.vmp1
Size: 6.3MB - Virtual size: 6.3MB

.reloc
Size: 512B - Virtual size: 232B

.rsrc
Size: 512B - Virtual size: 480B