558180978c9b9419edfc94f7d6bf66923502eb66f7702384413bf98ec9327b7a

Sharing

Copy URL Twitter E-mail

General

Target

558180978c9b9419edfc94f7d6bf66923502eb66f7702384413bf98ec9327b7a
Size

10.6MB
MD5

b121a09146431f32625aaeafb38fa2f2
SHA1

ab77d72503419f72773f8d6444063132ab87951f
SHA256

558180978c9b9419edfc94f7d6bf66923502eb66f7702384413bf98ec9327b7a
SHA512

84168197dd5cba29cf197b7fdc4596b2e32e767c5bea5570926fe60d90e4dc3079518ca4cdfaba90405d09810d66c8418949e71eae6837225404027d2384e980
SSDEEP

196608:GQ9hESKP+6Zs3ovUlKDkqUqL9xHjR8YgKfmWvT2piRXUe1eFRp0F:GQTNKP+aUlKDSwxjjmqVRXUe1eFRp0F

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
558180978c9b9419edfc94f7d6bf66923502eb66f7702384413bf98ec9327b7a

Files

558180978c9b9419edfc94f7d6bf66923502eb66f7702384413bf98ec9327b7a
.exe windows:6 windows x86 arch:x86

8bcce3436d31855cf30323c4329ed3ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libcurl

curl_slist_append

version

GetFileVersionInfoA

kernel32

GetVersionExW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CharUpperW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

advapi32

AdjustTokenPrivileges

shell32

SHGetPathFromIDListW

sdl2_image

IMG_LoadPNG_MEM

sdl2_mixer

Mix_LoadWAV_RW

sdl2_ttf

TTF_Quit

sdl2

SDL_SetMainReady

libpng32-32

png_init

msvcp120d

??7ios_base@std@@QBE_NXZ

ws2_32

ioctlsocket

msvcr120d

isspace

netapi32

Netbios

dbghelp

MiniDumpWriteDump

opencc

opencc_convert_utf8_free

clinkapi

clinkStart

wtsapi32

WTSSendMessageW

Sections

.textbss
Size: - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: - Virtual size: 9.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 570.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 10.5MB - Virtual size: 10.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8bcce3436d31855cf30323c4329ed3ae

Headers

DLL Characteristics

File Characteristics

Imports

libcurl

version

kernel32

user32

advapi32

shell32

sdl2_image

sdl2_mixer

sdl2_ttf

sdl2

libpng32-32

msvcp120d

ws2_32

msvcr120d

netapi32

dbghelp

opencc

clinkapi

wtsapi32

Sections

.textbss Size: - Virtual size: 4.4MB

.text Size: - Virtual size: 9.2MB

.rdata Size: - Virtual size: 1.6MB

.data Size: - Virtual size: 570.3MB

.idata Size: - Virtual size: 18KB

.vmp0 Size: - Virtual size: 6.2MB

.vmp1 Size: 10.5MB - Virtual size: 10.5MB

.reloc Size: 1KB - Virtual size: 1KB

.rsrc Size: 67KB - Virtual size: 67KB

.textbss
Size: - Virtual size: 4.4MB

.text
Size: - Virtual size: 9.2MB

.rdata
Size: - Virtual size: 1.6MB

.data
Size: - Virtual size: 570.3MB

.idata
Size: - Virtual size: 18KB

.vmp0
Size: - Virtual size: 6.2MB

.vmp1
Size: 10.5MB - Virtual size: 10.5MB

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 67KB - Virtual size: 67KB