bf22196d70fbd83cb4b311d2ebf444ef

Sharing

Copy URL Twitter E-mail

General

Target
bf22196d70fbd83cb4b311d2ebf444ef
Size 3.7MB
Sample220715-ej4mpsdddr
SHA256 dd112bfd7911a42d69b370c981ba55c1f1e3e00a671e764c0f1868a928b1fcd5
MD5 bf22196d70fbd83cb4b311d2ebf444ef
SHA1 b1f91a71dddf3720b40692559bfd53310b6b8ef3
SHA512 b1950aea1cb3d690dc13fdac19dc5d794b00439a9ce84417531131f5b5c400c0daa6e0ed461f2d8b2dba6aafb9f101efdde6fd3a8c0fab3581cf7373bd3a0a29
SSDEEP 98304:hHFnMc//FeBSSDNSj0BwimqjKffzmWxiXatDby5WRybILN0ZXuUZ:NZMcw1NSwwZqYm+iKta2y4Nuu0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

bf22196d70fbd83cb4b311d2ebf444ef

.exe 3.7MB

bf22196d70fbd83cb4b311d2ebf444ef

IMPHASH bb46f1abb2c1ede95f964a725f9d1284
SHA256 dd112bfd7911a42d69b370c981ba55c1f1e3e00a671e764c0f1868a928b1fcd5
MD5 bf22196d70fbd83cb4b311d2ebf444ef
SHA1 b1f91a71dddf3720b40692559bfd53310b6b8ef3
SHA512 b1950aea1cb3d690dc13fdac19dc5d794b00439a9ce84417531131f5b5c400c0daa6e0ed461f2d8b2dba6aafb9f101efdde6fd3a8c0fab3581cf7373bd3a0a29
SSDEEP 98304:hHFnMc//FeBSSDNSj0BwimqjKffzmWxiXatDby5WRybILN0ZXuUZ:NZMcw1NSwwZqYm+iKta2y4Nuu0
MD5 SHA1 SHA512 SSDEEP

windows x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Minor OS version

Major OS version

Entry point

2996767

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

862KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

bf22196d70fbd83cb4b311d2ebf444ef

kernel32

advapi32

shell32

winhttp

crypt32

user32