d606d0ccdcf4f92caea2a66b4364d3f08a8401a7d85de891c0bbae601675f308

Sharing

Copy URL Twitter E-mail

General

Target

d606d0ccdcf4f92caea2a66b4364d3f08a8401a7d85de891c0bbae601675f308
Size

3.9MB
MD5

9038abdc394db3a23b55f7ac9b1e5eb7
SHA1

8e2c35326d6bf831833e5f19c8b17a84e21fa0b2
SHA256

d606d0ccdcf4f92caea2a66b4364d3f08a8401a7d85de891c0bbae601675f308
SHA512

06d7fec8e2e09f15170917aee652880b3cbfd5aad3b521e96f8d97aef36b2635d017cdd81faa9f6fe24c2549193efee9bf4cf7e5b862118a980285c669e73676
SSDEEP

98304:3+kVgNq9rpypx2oNWkkoKMnv0fKOrZtW9O5c:3+sb9typgzkkoKMnv0/ZQOS

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d606d0ccdcf4f92caea2a66b4364d3f08a8401a7d85de891c0bbae601675f308

Files

d606d0ccdcf4f92caea2a66b4364d3f08a8401a7d85de891c0bbae601675f308
.exe windows:5 windows x86 arch:x86

f21ca2c85bde45f6977df267580877e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ice33

?__gcReachable@Object@Ice@@UBEXAAV?$map@PAVGCShared@IceInternal@@HU?$less@PAVGCShared@IceInternal@@@std@@V?$allocator@U?$pair@QAVGCShared@IceInternal@@H@std@@@4@@std@@@Z

iceutil33

?__incRef@Shared@IceUtil@@UAEXXZ

kernel32

GetVersionExA
SuspendThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

DefWindowProcA

gdi32

BitBlt

advapi32

AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathA

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z

wininet

InternetReadFile

zbl

zbl_msleep

wsock32

send

msvcr90

??0exception@std@@QAE@XZ

psapi

GetModuleFileNameExA

version

VerQueryValueA

dbghelp

MiniDumpWriteDump

netapi32

NetWkstaGetInfo

shlwapi

PathFileExistsA

gdiplus

GdipCloneImage

iphlpapi

GetTcpTable

libcurl

curl_easy_perform

wpcap

pcap_setmintocopy

libnet

libnet_init

zlib1

inflate

ole32

CoInitialize

ws2_32

getaddrinfo

Sections

.text
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f21ca2c85bde45f6977df267580877e3

Headers

DLL Characteristics

File Characteristics

Imports

ice33

iceutil33

kernel32

user32

gdi32

advapi32

shell32

msvcp90

wininet

zbl

wsock32

msvcr90

psapi

version

dbghelp

netapi32

shlwapi

gdiplus

iphlpapi

libcurl

wpcap

libnet

zlib1

ole32

ws2_32

Sections

.text Size: - Virtual size: 1.7MB

.rdata Size: - Virtual size: 450KB

.data Size: - Virtual size: 115KB

.vmp0 Size: - Virtual size: 3.7MB

.vmp1 Size: 3.9MB - Virtual size: 3.9MB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 1.7MB

.rdata
Size: - Virtual size: 450KB

.data
Size: - Virtual size: 115KB

.vmp0
Size: - Virtual size: 3.7MB

.vmp1
Size: 3.9MB - Virtual size: 3.9MB

.rsrc
Size: 1KB - Virtual size: 1KB