c45faa02fdd378d5098f1e4132e3fbac

Sharing

Copy URL

Twitter E-mail

General

Target

c45faa02fdd378d5098f1e4132e3fbac
Size

5.3MB
MD5

c45faa02fdd378d5098f1e4132e3fbac
SHA1

c3c4535fa1032d8110db264a2c386c6bb5bd4de8
SHA256

c5e6c279e9383f9f26903381952a2b9f623f6b8a0c724bfaa5fc38ca69825423
SHA512

8660abbd84464ea61e3884899afe3f3c5052ba1095ced6fdb9cb1f5154b3d915c3071bea65a2c4269f335f45de242d67542674d4769b51dca381b7decaa4019d
SSDEEP

98304:je4cj4NrLIeoLWO342nLzGFTLlyCxGE8ZQZj/PPxyt:Y4CeJs4MGFTECUEjj/RG

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c45faa02fdd378d5098f1e4132e3fbac

Files

c45faa02fdd378d5098f1e4132e3fbac
.exe windows:6 windows x64 arch:x64

8ac3dab2d49cf9861ac6a3f274034a8c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

OpenProcessToken

kernel32

GetCurrentProcess
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

wtsapi32

WTSSendMessageW

user32

GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ac3dab2d49cf9861ac6a3f274034a8c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

wtsapi32

user32

Sections

.text Size: - Virtual size: 173KB

.rdata Size: - Virtual size: 79KB

.data Size: - Virtual size: 11KB

.pdata Size: - Virtual size: 9KB

_RDATA Size: - Virtual size: 244B

.vmp0 Size: - Virtual size: 3.3MB

.vmp1 Size: 5.3MB - Virtual size: 5.3MB

.reloc Size: 512B - Virtual size: 172B

.rsrc Size: 1024B - Virtual size: 636B

.text
Size: - Virtual size: 173KB

.rdata
Size: - Virtual size: 79KB

.data
Size: - Virtual size: 11KB

.pdata
Size: - Virtual size: 9KB

_RDATA
Size: - Virtual size: 244B

.vmp0
Size: - Virtual size: 3.3MB

.vmp1
Size: 5.3MB - Virtual size: 5.3MB

.reloc
Size: 512B - Virtual size: 172B

.rsrc
Size: 1024B - Virtual size: 636B