b46bc87cb9e27de6793713e80f29d650ec01f0e53dcd175cc42297afb8365a56 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b46bc87cb9e27de6793713e80f29d650ec01f0e53dcd175cc42297afb8365a56
Size

4.7MB
MD5

b9d9f3836f62860fd064166498376aad
SHA1

df4bd75d326b1f53868961eb4e8b8d9dad83e9b5
SHA256

b46bc87cb9e27de6793713e80f29d650ec01f0e53dcd175cc42297afb8365a56
SHA512

5ec042eaca9374f2d9d5530af94302ae42c5f74161ed37485fdae52ef9427cf43e74b84645a362489c42388c260144ed83c446e7fcbcc26635b6f9d8fc911fde
SSDEEP

98304:pCfXU+iqOnw0D51QaYz0VD108Osw7BFHZ3bTTvg3TIdVxYAlJ:pqXBSD8Tz0R1wHZrTLwsx

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

b46bc87cb9e27de6793713e80f29d650ec01f0e53dcd175cc42297afb8365a56
.exe windows x86

fab4f8e83faf17c57d20c1a3dcb2457c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

kernel32

FreeLibrary
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

RegQueryValueExA

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 548B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ