2be4cba59cf9e4e0ea0ca3d27dc1ce48[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2be4cba59cf9e4e0ea0ca3d27dc1ce48.exe
Size 3.5MB
Sample220512-hcbvwsagd7
SHA256 27df4a63c80cda5fe053fe672fbc327bf268d8656c354099f004e41c3b95fb52
MD5 2be4cba59cf9e4e0ea0ca3d27dc1ce48
SHA1 9fe40bdbefea9284b8e7b85712a4fde9dfa24136
SHA512 4e75a090b4fee113632c17ba3ab4fe4fafb0da89399f50a4022f01b83ef905200053cfd551c56dbdb71e3c5aca3bded872e78fe8a8d41074e6c246a914e235e3
SSDEEP 98304:jne6W/AKEkCGz7FTuYTK3PUgkngBdgoY:j2pCQwP+g
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

2be4cba59cf9e4e0ea0ca3d27dc1ce48.exe

.exe 3.5MB

2be4cba59cf9e4e0ea0ca3d27dc1ce48.exe

IMPHASH bb46f1abb2c1ede95f964a725f9d1284
SHA256 27df4a63c80cda5fe053fe672fbc327bf268d8656c354099f004e41c3b95fb52
MD5 2be4cba59cf9e4e0ea0ca3d27dc1ce48
SHA1 9fe40bdbefea9284b8e7b85712a4fde9dfa24136
SHA512 4e75a090b4fee113632c17ba3ab4fe4fafb0da89399f50a4022f01b83ef905200053cfd551c56dbdb71e3c5aca3bded872e78fe8a8d41074e6c246a914e235e3
SSDEEP 98304:jne6W/AKEkCGz7FTuYTK3PUgkngBdgoY:j2pCQwP+g
MD5 SHA1 SHA512 SSDEEP

windows x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Minor OS version

Major OS version

Entry point

4886621

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

871KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2be4cba59cf9e4e0ea0ca3d27dc1ce48.exe

kernel32

advapi32

shell32

winhttp

crypt32

user32