54baf2ca95fb219f3566092eed65a16d[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
54baf2ca95fb219f3566092eed65a16d.exe
Size 3.5MB
Sample220523-vmd48agbc9
SHA256 d71279d97daf5603d9c3d2d409ce00ee746eb41b8c8ceb3450f7bdc590847976
MD5 54baf2ca95fb219f3566092eed65a16d
SHA1 fafc1ba8877666276eb9e87734b22e09a092203a
SHA512 4140aa4f8120051d577efa2f7ea95aa701639ed6cf2be4a33be7fe5d91dfd2579b54522c8c5be39c999a85fc3f23d0e16d23889b2d68d80e363087fa8140843b
SSDEEP 49152:vu5cGOiBj3SGmVh6X9wWZ40B8XKv3H0tIWt5DboCN4YAxQxSApphjs2ULD:6NOiBjC9h6XXnB8XO3H0hnb1AxEpY/
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

54baf2ca95fb219f3566092eed65a16d.exe

.exe 3.5MB

54baf2ca95fb219f3566092eed65a16d.exe

IMPHASH bb46f1abb2c1ede95f964a725f9d1284
SHA256 d71279d97daf5603d9c3d2d409ce00ee746eb41b8c8ceb3450f7bdc590847976
MD5 54baf2ca95fb219f3566092eed65a16d
SHA1 fafc1ba8877666276eb9e87734b22e09a092203a
SHA512 4140aa4f8120051d577efa2f7ea95aa701639ed6cf2be4a33be7fe5d91dfd2579b54522c8c5be39c999a85fc3f23d0e16d23889b2d68d80e363087fa8140843b
SSDEEP 49152:vu5cGOiBj3SGmVh6X9wWZ40B8XKv3H0tIWt5DboCN4YAxQxSApphjs2ULD:6NOiBjC9h6XXnB8XO3H0hnb1AxEpY/
MD5 SHA1 SHA512 SSDEEP

windows x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Minor OS version

Major OS version

Entry point

4520937

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

871KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

54baf2ca95fb219f3566092eed65a16d.exe

kernel32

advapi32

shell32

winhttp

crypt32

user32