b8ed31eb899b88997864d875dc5569a61252e1f395902a567fdd745cf8e6c9e7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b8ed31eb899b88997864d875dc5569a61252e1f395902a567fdd745cf8e6c9e7
Size

984KB
MD5

051962874432bd47eac5b49259091f10
SHA1

ea4dbdcb91c6b68c0a795d4bcd24e85ab1195608
SHA256

b8ed31eb899b88997864d875dc5569a61252e1f395902a567fdd745cf8e6c9e7
SHA512

ef5d67e0dce987585f3b86373387ca5ac887e796886ebe5fbb3e3cedd8e62cc495e869cfc78016d66f412ef2421fe6f6e83d3684be5fb61f6086191cd2f16457
SSDEEP

12288:N8Cl6D7kWXyDzeB6hTX2CKckfmUz53Ls6A7p8EHEIQdWIeIzlfnZg9wWFo1c+E:Nc0kyDW6pIiu53LRSp8EkIQdWcJhVOh

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

b8ed31eb899b88997864d875dc5569a61252e1f395902a567fdd745cf8e6c9e7
.exe windows x86

bec368304e3ba739df9f8476756053c6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaStrFixstr

kernel32

HeapReAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 968KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 972KB - Virtual size: 971KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ