fdb6e3c40fb3eb9e43fbefccfe3f6f4019cc9d88fde583b8f13012306c3a1ab2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fdb6e3c40fb3eb9e43fbefccfe3f6f4019cc9d88fde583b8f13012306c3a1ab2
Size

289KB
MD5

41a290fd2398224534366f667f4ba7a0
SHA1

c2f0e6574b46670cb5d4bee195100cc2e22be908
SHA256

fdb6e3c40fb3eb9e43fbefccfe3f6f4019cc9d88fde583b8f13012306c3a1ab2
SHA512

f879edf95689c5ec257967b12039bd1b1e145c38ea113b5f34481b4f67d9847a0a6542e4e1180a6a69ce7bd26b948bce3c312fea8a7f04e3efe73d6237e5ae73
SSDEEP

6144:eh6pLonJkmnRaiaf4MtkE9f7orVKUZb95g24uKLWO0NE7bAsp/kWKFD:e8poJkaRmfFtDfsRnl/lP+1cBD

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

fdb6e3c40fb3eb9e43fbefccfe3f6f4019cc9d88fde583b8f13012306c3a1ab2
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 633KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ