53685dec1318d165d11637a487b2a339db33a633eef3c888ef7b01425bf8b18f

Sharing

Copy URL Twitter E-mail

General

Target

53685dec1318d165d11637a487b2a339db33a633eef3c888ef7b01425bf8b18f
Size

1.3MB
MD5

6fa323850774d5c9042dce14cec62403
SHA1

4082c9d7b733ba4a2c25c9ecc8d3db7c041e1e6b
SHA256

53685dec1318d165d11637a487b2a339db33a633eef3c888ef7b01425bf8b18f
SHA512

48b411fa91f09b1e7b2d3ac666166968fbb1b038676843443492160c9bdeff4891accc72a4724f4f3f60fb390dcf5dc4635d42be816073bc169092615d8fe82c
SSDEEP

24576:KP4ZE7lUQJqiwjR4SKTrKxGPOgmScbkYdFvyBQAXC1Vu:KPD7lRIfqSgdvhatdEB1Xow

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53685dec1318d165d11637a487b2a339db33a633eef3c888ef7b01425bf8b18f

Files

53685dec1318d165d11637a487b2a339db33a633eef3c888ef7b01425bf8b18f
.dll windows:4 windows x86 arch:x86

67a3dd9c24bbf0b8db8a002530f55f81

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLocaleInfoW
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

CreateMenu
MessageBoxA

gdi32

CombineRgn

comdlg32

CommDlgExtendedError

winspool.drv

OpenPrinterA

advapi32

RegDeleteValueA

shell32

SHGetFileInfoA

comctl32

ord17

oledlg

ord3

ole32

CreateStreamOnHGlobal

olepro32

ord253

oleaut32

VarCyFromStr

Exports

Exports

GetInstallDetailsPayload
SignalChromeElf
SignalInitializeCrashReporting
StartAntiLsp

Sections

.text
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 864KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

67a3dd9c24bbf0b8db8a002530f55f81

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Exports

Exports

Sections

.text Size: - Virtual size: 1.8MB

.rdata Size: - Virtual size: 132KB

.data Size: - Virtual size: 101KB

.idata Size: - Virtual size: 22KB

.rsrc Size: 4KB - Virtual size: 12KB

.vmp0 Size: - Virtual size: 76KB

.vmp1 Size: - Virtual size: 864KB

.vmp2 Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 4KB - Virtual size: 184B

.text
Size: - Virtual size: 1.8MB

.rdata
Size: - Virtual size: 132KB

.data
Size: - Virtual size: 101KB

.idata
Size: - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 12KB

.vmp0
Size: - Virtual size: 76KB

.vmp1
Size: - Virtual size: 864KB

.vmp2
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 4KB - Virtual size: 184B