6e6a4d54f3158c7a10680c05e2c734c0917c2c0bdb2fad10abd6267b7b5a1c96

Sharing

Copy URL Twitter E-mail

General

Target

6e6a4d54f3158c7a10680c05e2c734c0917c2c0bdb2fad10abd6267b7b5a1c96
Size

2.9MB
MD5

11b9b35d49031a9f24487eb1777f6a7f
SHA1

9cc51c0b4e4963ca0871f4ef7d5deadef53dd433
SHA256

6e6a4d54f3158c7a10680c05e2c734c0917c2c0bdb2fad10abd6267b7b5a1c96
SHA512

45aaa02dd4ab021e14e5f6ce73aebe56a445cad60f70c165dd2a84701821776d0b62b3f6db4bc9e6379145f87f9fbb23d055cc2d303d90b246069a901935be41
SSDEEP

49152:5pbHp4AQUg2mh6mcLwy33VqIp8jPa4du/SKZK6qguGzoY7QEBP1of6tom6ro8J9B:7J4ABgYqIp+Hu/w4u6bN/ymH8JX

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e6a4d54f3158c7a10680c05e2c734c0917c2c0bdb2fad10abd6267b7b5a1c96

Files

6e6a4d54f3158c7a10680c05e2c734c0917c2c0bdb2fad10abd6267b7b5a1c96
.exe windows:5 windows x86 arch:x86

10f2360d952d6eecac2191f46b4d5f94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExW
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

RegisterClipboardFormatW
CharUpperBuffW

gdi32

ExtSelectClipRgn

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW

advapi32

RegCreateKeyExW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

SHGetFileInfoW

comctl32

_TrackMouseEvent

shlwapi

PathFindExtensionW

oledlg

OleUIBusyW

ole32

CoFreeUnusedLibraries

oleaut32

SysFreeString

version

GetFileVersionInfoW

psapi

GetProcessImageFileNameW

iphlpapi

GetAdaptersInfo

rpcrt4

UuidCreateSequential

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 321KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.maopo
Size: - Virtual size: 1.0MB

IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10f2360d952d6eecac2191f46b4d5f94

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

version

psapi

iphlpapi

rpcrt4

wtsapi32

Sections

.text Size: - Virtual size: 321KB

.rdata Size: - Virtual size: 71KB

.data Size: - Virtual size: 30KB

.vmp0 Size: - Virtual size: 185KB

.maopo Size: - Virtual size: 1.0MB

.vmp1 Size: - Virtual size: 1.9MB

.vmp2 Size: 2.7MB - Virtual size: 2.7MB

.reloc Size: 512B - Virtual size: 268B

.rsrc Size: 173KB - Virtual size: 173KB

.text
Size: - Virtual size: 321KB

.rdata
Size: - Virtual size: 71KB

.data
Size: - Virtual size: 30KB

.vmp0
Size: - Virtual size: 185KB

.maopo
Size: - Virtual size: 1.0MB

.vmp1
Size: - Virtual size: 1.9MB

.vmp2
Size: 2.7MB - Virtual size: 2.7MB

.reloc
Size: 512B - Virtual size: 268B

.rsrc
Size: 173KB - Virtual size: 173KB