af8d77e1cc185884e20bfab776f555e6fbe60af49a564004115f4e1b34656a26 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af8d77e1cc185884e20bfab776f555e6fbe60af49a564004115f4e1b34656a26
Size

678KB
MD5

4cbf4782827eca944ff67d8d22d91750
SHA1

c09995d6d96d82b5943f227df9294f0434b22005
SHA256

af8d77e1cc185884e20bfab776f555e6fbe60af49a564004115f4e1b34656a26
SHA512

914213284e1a704f9793f30f99edb6c5e59e05aa78b0d4cdda932474f30f1ee7a2b7583972c131602cdbeab87353767a3b064899f2686fa3ab3292bd50494249
SSDEEP

12288:uGhsRHHMrFFMjF3jyY8cUUkxaxfBYGhLxCef+22d+I9cyp96ktJ+l+1A:uGG1MrbANjZ8cBOaxpZCofoRouJQ+1

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

af8d77e1cc185884e20bfab776f555e6fbe60af49a564004115f4e1b34656a26
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

GlowStorm

Sections

.text
Size: - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 569KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 676KB - Virtual size: 676KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ