721306034c716d214091e2093b0540de987ecdcda77ab30018e177007d8e16fb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

721306034c716d214091e2093b0540de987ecdcda77ab30018e177007d8e16fb
Size

688KB
MD5

67cee05cf2b7c6febeae6ebde9471468
SHA1

4e61584f7c8238725aef69babd4896b0ee30528f
SHA256

721306034c716d214091e2093b0540de987ecdcda77ab30018e177007d8e16fb
SHA512

69f0efd28a4057c04a13ce30f46e8b9efacbd06a08a73717778254dae55101a81f5e104205bf6f0d7fa6abfee77b17e356818ef8abbba2ec955730647c20419e
SSDEEP

12288:3Kx6ZfnJ16avlu5QuW2wIn18xXjWKMr7RBVOd0cK7XNPOV9SUryKT76d7IiEY:3j34Cc3n18NjRM3RDOd0cK7XNPOVB6dU

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

721306034c716d214091e2093b0540de987ecdcda77ab30018e177007d8e16fb
.exe windows x86

bc54a94d9524ffa2d31a95a6e589cb51

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 504KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 680KB - Virtual size: 678KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ