fce7b057b29d60975a6be1b2ae1fd6795b1eee39a8f5b43727bc4037b5bb5d4d

Sharing

Copy URL Twitter E-mail

General

Target

fce7b057b29d60975a6be1b2ae1fd6795b1eee39a8f5b43727bc4037b5bb5d4d
Size

1.3MB
MD5

bc609d95ebb9982ed0586c2708bd99ac
SHA1

1a4cbff2656ddd10c7bfc0fe65a08d3d21878103
SHA256

fce7b057b29d60975a6be1b2ae1fd6795b1eee39a8f5b43727bc4037b5bb5d4d
SHA512

b89074a31a9381fe053fe9f0bb16d178719d870706751526c1753b95534d53beff113316fec1682685fa49db6aa4657b3086e5ecc2aff5781ba97642e9a21909
SSDEEP

24576:SDINLgWdcy7JPhhFREwQ8xU1rgSV2NkmKioBxsKaO/QhZcQ7:9dckJHFRZSFv8kKoB9azh57

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fce7b057b29d60975a6be1b2ae1fd6795b1eee39a8f5b43727bc4037b5bb5d4d

Files

fce7b057b29d60975a6be1b2ae1fd6795b1eee39a8f5b43727bc4037b5bb5d4d
.dll windows:4 windows x86 arch:x86

8da62668d6e93aeb558cfed1c1cf8347

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLocaleInfoW
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

CreateMenu
MessageBoxA

gdi32

CreatePolyPolygonRgn

comdlg32

ChooseColorA

winspool.drv

OpenPrinterA

advapi32

RegDeleteValueA

shell32

ExtractIconA

comctl32

ord17

oledlg

ord3

ole32

CreateStreamOnHGlobal

olepro32

ord253

oleaut32

VarCyFromStr

Exports

Exports

GetInstallDetailsPayload
SignalChromeElf
SignalInitializeCrashReporting
StartAntiLsp

Sections

.text
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 881KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8da62668d6e93aeb558cfed1c1cf8347

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Exports

Exports

Sections

.text Size: - Virtual size: 1.8MB

.rdata Size: - Virtual size: 133KB

.data Size: - Virtual size: 103KB

.idata Size: - Virtual size: 22KB

.rsrc Size: 8KB - Virtual size: 18KB

.vmp0 Size: - Virtual size: 77KB

.vmp1 Size: - Virtual size: 881KB

.vmp2 Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 4KB - Virtual size: 152B

.text
Size: - Virtual size: 1.8MB

.rdata
Size: - Virtual size: 133KB

.data
Size: - Virtual size: 103KB

.idata
Size: - Virtual size: 22KB

.rsrc
Size: 8KB - Virtual size: 18KB

.vmp0
Size: - Virtual size: 77KB

.vmp1
Size: - Virtual size: 881KB

.vmp2
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 4KB - Virtual size: 152B