3cb4050544f22e9adfa49585866df8cd815344747bc74b82468faff4e36523f3 | Triage

Sharing

General

Target

3cb4050544f22e9adfa49585866df8cd815344747bc74b82468faff4e36523f3
Size

5.7MB
MD5

049f2156be0f3e4f27637def01bf4957
SHA1

bb18618c3129f5d164599b1e44bd59af08e986d0
SHA256

3cb4050544f22e9adfa49585866df8cd815344747bc74b82468faff4e36523f3
SHA512

64a736aab483face7679ecb70a1ccdcbf24d23cf15a6f892277d66d8c5c615e748302d63196e41597224dea0383090313f19cd6137d8ef5f4f7e9b0782e02d90

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

3cb4050544f22e9adfa49585866df8cd815344747bc74b82468faff4e36523f3
.exe windows x86

b0a3c6817c3bc91463a81826e090915c

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetDC
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

gdi32

DeleteObject

shlwapi

PathFindExtensionW

gdiplus

GdipSaveImageToFile

wininet

InternetWriteFile

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 533KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ