c929e00cf303bb0bb786c5e39064bc56

Sharing

Copy URL Twitter E-mail

General

Target

c929e00cf303bb0bb786c5e39064bc56
Size

117KB
MD5

c929e00cf303bb0bb786c5e39064bc56
SHA1

55bf67f2c272449c7456b6873625b8e1ac060dcd
SHA256

e5b051960e1582a01ab232127a4ddfb38e6b538752be30cee1a56e849adda2f9
SHA512

6665afb136874de871b0db72f4ac6865a2eb75c80f519a5881d8c65643adce909be6fd38eeeb0c5b6512c1ec7539dc3fba2ab13dc3a0c3b0334113bc0f127682
SSDEEP

1536:TjxCKbfyAZipRXxfqPFrZ59IKkET53CAALNYveEwD5v1/PH9dyXT1f3:wKDyAZMqPZicT8EwD5vZyBf3

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c929e00cf303bb0bb786c5e39064bc56

Files

c929e00cf303bb0bb786c5e39064bc56
.dll windows:5 windows x86 arch:x86

87996cca75cdd663a2c78f763cccd44f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtectEx
OpenProcess
GetCurrentProcessId
FreeLibrary
GetProcAddress
LoadLibraryA
ReleaseMutex
lstrcmpA
WaitForSingleObject
lstrcpyA
SuspendThread
OpenThread
Thread32Next
Thread32First
CreateToolhelp32Snapshot
Process32Next
Process32First
CreateRemoteThread
VirtualAllocEx
CreateThread
CreateMutexA
SetErrorMode
GetTickCount
ExitThread
WriteProcessMemory
FlushFileBuffers
CreateFileA
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RtlUnwind
InitializeCriticalSectionAndSpinCount
HeapReAlloc
VirtualAlloc
HeapAlloc
GetConsoleMode
GetConsoleCP
WriteFile
SetFilePointer
GetLocaleInfoA
GetCurrentProcess
GetLastError
CloseHandle
Sleep
EnterCriticalSection
ExitProcess
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
LeaveCriticalSection

user32

GetForegroundWindow
GetClassNameA
GetWindowThreadProcessId
SetWindowsHookExA
SetForegroundWindow
GetKeyState
CallNextHookEx
DialogBoxParamA
MessageBoxA
ShowWindow
CreateDialogParamA
GetMessageExtraInfo
SendInput
GetDlgItemTextA
SendDlgItemMessageA
GetDlgItemInt
SetWindowTextA
GetWindowTextA
SendMessageA
SetDlgItemTextA
GetDlgItem
EnableWindow
IsDlgButtonChecked
UnhookWindowsHookEx
MapVirtualKeyW

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

psapi

GetModuleFileNameExA
GetMappedFileNameA

comctl32

ord17

Exports

Exports

CheckTaskProcess
EncrytData
EncrytData_2
EncrytMessage
GetLoginText
GetMirText
HelloWord
INitStringData
InitMirProcess
InstallHook
ReadGameVals
ReadMirProcess
RestoneProcessToGame
RestoneProcessToGame2
RetToGameProcess
SetChangeVirtulName
UninstallHook
WriteMirProcess
WriteMirProcess_2
_CheckTaskProcess@0
_EncrytData@12
_EncrytData_2@12
_EncrytMessage@12
_GetLoginText@12
_GetMirText@12
_HelloWord@0
_INitStringData@12
_InitMirProcess@16
_InstallHook@0
_ReadGameVals@4
_ReadMirProcess@12
_RestoneProcessToGame2@4
_RestoneProcessToGame@4
_RetToGameProcess@4
_SetChangeVirtulName@12
_UninstallHook@0
_WriteMirProcess@12
_WriteMirProcess_2@12

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

she
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87996cca75cdd663a2c78f763cccd44f

Headers

File Characteristics

Imports

kernel32

user32

advapi32

psapi

comctl32

Exports

Exports

Sections

.text Size: 74KB - Virtual size: 73KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 5KB - Virtual size: 146KB

she Size: 512B - Virtual size: 12B

.rsrc Size: 5KB - Virtual size: 5KB

.vmp0 Size: 7KB - Virtual size: 7KB

.vmp1 Size: 6KB - Virtual size: 6KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 74KB - Virtual size: 73KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 5KB - Virtual size: 146KB

she
Size: 512B - Virtual size: 12B

.rsrc
Size: 5KB - Virtual size: 5KB

.vmp0
Size: 7KB - Virtual size: 7KB

.vmp1
Size: 6KB - Virtual size: 6KB

.reloc
Size: 5KB - Virtual size: 5KB