ba15040739bc79b5cb82ded502c6e08a

Sharing

Copy URL Twitter E-mail

General

Target
ba15040739bc79b5cb82ded502c6e08a
Size 3.8MB
Sample220820-b2dmfsfff4
SHA256 c05f56868d416007cd4943311e13f939a5dfdacee7eea63aca12ef574a777a7c
MD5 ba15040739bc79b5cb82ded502c6e08a
SHA1 7d715d801bdba7043c1bf71187bba1216de69256
SHA512 e65acdd7ea96ce52cc4a18d36c68f660d2f79a61015a9a8a605f51844bfde31583d9839258aad9910e5056b911a63c0add68a57be00fab363626ad809bcea25c
SSDEEP 49152:mBeGSXcxidYHOIzAem/cTCaxjL42n5JoO02hIPT7Cv9q7VFUqpqDRyZJkjt6Zf+e:mBeGgguIUDkdxVouAJ7VKqE6aBtTlUD
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

ba15040739bc79b5cb82ded502c6e08a

.exe 3.8MB

ba15040739bc79b5cb82ded502c6e08a

IMPHASH bb46f1abb2c1ede95f964a725f9d1284
SHA256 c05f56868d416007cd4943311e13f939a5dfdacee7eea63aca12ef574a777a7c
MD5 ba15040739bc79b5cb82ded502c6e08a
SHA1 7d715d801bdba7043c1bf71187bba1216de69256
SHA512 e65acdd7ea96ce52cc4a18d36c68f660d2f79a61015a9a8a605f51844bfde31583d9839258aad9910e5056b911a63c0add68a57be00fab363626ad809bcea25c
SSDEEP 49152:mBeGSXcxidYHOIzAem/cTCaxjL42n5JoO02hIPT7Cv9q7VFUqpqDRyZJkjt6Zf+e:mBeGgguIUDkdxVouAJ7VKqE6aBtTlUD
MD5 SHA1 SHA512 SSDEEP

windows x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Minor OS version

Major OS version

Entry point

3007115

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

862KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

ba15040739bc79b5cb82ded502c6e08a

kernel32

advapi32

shell32

winhttp

crypt32

user32