878b117c8a9cafcfbff1f15f9f612d00740e84714c301691e73d15fe659cc82f

Sharing

Copy URL

Twitter E-mail

General

Target

878b117c8a9cafcfbff1f15f9f612d00740e84714c301691e73d15fe659cc82f
Size

3.1MB
MD5

8359a916072d954d3020c950320e02ae
SHA1

96045f99b9fd7ed2d56e84f5a09da46fb7725608
SHA256

878b117c8a9cafcfbff1f15f9f612d00740e84714c301691e73d15fe659cc82f
SHA512

529c7ff418d0019a641fcbb320beb0e86a3760fff4aadeb2b2ea19b6d616f693854cc1140cc6a808a958e4327255a531ed2b92d8c0156818d0411091a5971565
SSDEEP

98304:ddNFlUNwg0Z0tvu39hmW0a8O0yuVMWgzgU9:dVSOgdvu3iW0aNuVMdg

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
878b117c8a9cafcfbff1f15f9f612d00740e84714c301691e73d15fe659cc82f

Files

878b117c8a9cafcfbff1f15f9f612d00740e84714c301691e73d15fe659cc82f
.exe windows:5 windows x86 arch:x86

2c886a563498cd122631f52d6529324c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

accept

wldap32

ord46

sqlite3

sqlite3_open

kernel32

GetVersionExW
GetVersionExA
GetVersion
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

PeekMessageW
CharUpperBuffW

advapi32

RegisterEventSourceA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

CommandLineToArgvW

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp100

?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

shlwapi

PathRemoveFileSpecW

dbghelp

MiniDumpWriteDump

wtsapi32

WTSQueryUserToken
WTSSendMessageW

userenv

DestroyEnvironmentBlock

msvcr100

strrchr

pdh

PdhRemoveCounter

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW

version

VerQueryValueW

winmm

timeBeginPeriod

Sections

.text
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2c886a563498cd122631f52d6529324c

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wldap32

sqlite3

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp100

shlwapi

dbghelp

wtsapi32

userenv

msvcr100

pdh

iphlpapi

psapi

version

winmm

Sections

.text Size: - Virtual size: 1.4MB

.rdata Size: - Virtual size: 417KB

.data Size: - Virtual size: 71KB

.tls Size: 512B - Virtual size: 2B

.vmp0 Size: - Virtual size: 2.4MB

.vmp1 Size: 3.1MB - Virtual size: 3.1MB

.reloc Size: 512B - Virtual size: 272B

.rsrc Size: 11KB - Virtual size: 11KB

.text
Size: - Virtual size: 1.4MB

.rdata
Size: - Virtual size: 417KB

.data
Size: - Virtual size: 71KB

.tls
Size: 512B - Virtual size: 2B

.vmp0
Size: - Virtual size: 2.4MB

.vmp1
Size: 3.1MB - Virtual size: 3.1MB

.reloc
Size: 512B - Virtual size: 272B

.rsrc
Size: 11KB - Virtual size: 11KB