fdad86b2ec983b35f5b1970a3635af5a02ae2269e0f5fe1a744d05d7c3105ee6 | Triage

Sharing

General

Target

fdad86b2ec983b35f5b1970a3635af5a02ae2269e0f5fe1a744d05d7c3105ee6
Size

316KB
MD5

60152b2d3c2c54772f11eda222640673
SHA1

9cfdf58876f6bda081e43db0167da624502dc480
SHA256

fdad86b2ec983b35f5b1970a3635af5a02ae2269e0f5fe1a744d05d7c3105ee6
SHA512

e07949ce3d8bc214f32a2e19b1f9208984c13e3bff2e6c9c8d435d86fa7aed0b68ff1d6f9cd7f1e00802ff87cca05d5e346f47b91517091882b2c4fb514f57b1
SSDEEP

6144:BfVx2LwyrmLzvY37qMLq8loLkSQ/Ep6VN4+4b3jXtoH:B29RLF6LeKh6H

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

sample vmprotect

Files

fdad86b2ec983b35f5b1970a3635af5a02ae2269e0f5fe1a744d05d7c3105ee6
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 313KB - Virtual size: 313KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ