c0b0316c27a3a72a0ab89f415013e210N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

c0b0316c27a3a72a0ab89f415013e210N.exe
Size

224KB
MD5

c0b0316c27a3a72a0ab89f415013e210
SHA1

136e8977d7615dd00569b3e96e75326907a97105
SHA256

07a32b2825e737650bc2bbd83b3d461488a83ef809b32a7fcb35bc456ddde2ca
SHA512

56ee1c2c58a22c5a82f3e529b0f4e556d62832cbcbf0a5a0e5f827a5b1053080bdf3bbe0e8307cb4f03abedc83d502edb5dbaec0cee9c07b7174d768a6c0991c
SSDEEP

6144:6ozpvYAEKssRl6Nd/IcnEV2lXh8Sh3oC:H9YAEKPRl6NpSVoIC

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0b0316c27a3a72a0ab89f415013e210N.exe

Files

c0b0316c27a3a72a0ab89f415013e210N.exe
.dll windows:4 windows x86 arch:x86

f5beae4b5af9c968b179848856eba0dc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
IsBadReadPtr
GetModuleFileNameA
DeleteFileA
WriteFile
CreateFileA
SetFileAttributesA
Sleep
LCMapStringA
GetTickCount
GetCommandLineA
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
FlushFileBuffers
SetStdHandle
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
LoadLibraryA
Beep
GetCurrentThread
GetProcAddress
GetModuleHandleA
lstrcpyn
CreateThread
RtlMoveMemory
MapViewOfFile
OpenFileMappingA
TerminateProcess
OpenProcess
Module32First
Process32Next
CloseHandle
GetCPInfo
Process32First
CreateToolhelp32Snapshot
GetTempPathA
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetVersion
InterlockedDecrement
InterlockedIncrement
RtlUnwind
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LCMapStringW
VirtualAlloc
RaiseException
SetFilePointer
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

GetKeyboardLayoutNameA
ActivateKeyboardLayout
GetKeyboardLayout
SystemParametersInfoA
GetKeyboardLayoutList
UnloadKeyboardLayout
PostMessageA
GetForegroundWindow
CallWindowProcA
GetWindowThreadProcessId
GetClassNameA
LoadKeyboardLayoutA
IsWindowVisible
GetWindow
GetDesktopWindow
MessageBoxA
wsprintfA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
GetWindowTextA
MessageBoxA

advapi32

RegOpenKeyA
RegDeleteValueA
RegEnumValueA
RegFlushKey
RegSetValueExA
RegCreateKeyA
RegCloseKey
RegDeleteKeyA
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA

shlwapi

PathFileExistsA

shell32

SHGetSpecialFolderPathA

Exports

Exports

cxcxcxcxa
cxcxcxcxb
cxcxcxcxc
cxcxcxcxd
cxcxcxcxe
cxcxcxcxf
��پ��

Sections

.text
Size: - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f5beae4b5af9c968b179848856eba0dc

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

shell32

Exports

Exports

Sections

.text Size: - Virtual size: 61KB

.rdata Size: - Virtual size: 5KB

.data Size: - Virtual size: 274KB

.rsrc Size: 4KB - Virtual size: 668B

.vmp0 Size: - Virtual size: 6KB

.vmp1 Size: - Virtual size: 30KB

.vmp2 Size: 212KB - Virtual size: 211KB

.reloc Size: 4KB - Virtual size: 76B

.text
Size: - Virtual size: 61KB

.rdata
Size: - Virtual size: 5KB

.data
Size: - Virtual size: 274KB

.rsrc
Size: 4KB - Virtual size: 668B

.vmp0
Size: - Virtual size: 6KB

.vmp1
Size: - Virtual size: 30KB

.vmp2
Size: 212KB - Virtual size: 211KB

.reloc
Size: 4KB - Virtual size: 76B