5916986c403a625aa27751911632b889d4e61e2523e4e36a1211bb1058203db7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5916986c403a625aa27751911632b889d4e61e2523e4e36a1211bb1058203db7
Size

148KB
MD5

41258f9f2b93ac9cd7a29103fad524af
SHA1

c21221b7d3a667b486ea1096e8f1bd66acd1a74e
SHA256

5916986c403a625aa27751911632b889d4e61e2523e4e36a1211bb1058203db7
SHA512

ef6746669c9e91695769dfa215e2430bd2dbd6712494fcdffbe2cc9e4a502cc64f770c74bf1bdd11cfaa4ad717a3dcea51edda9ba218e241e45307a762fc576f
SSDEEP

3072:eZUl7zaxoWelqTZqS74GOw/S1UCb1i4jFKUrAUFp8vTw63:ufTZ7cGqTb1ZRvrbH63

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

5916986c403a625aa27751911632b889d4e61e2523e4e36a1211bb1058203db7
.dll windows x86

404c7a06fee59ed2733521cf229ce99a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

ReleaseDC

gdi32

CreateSolidBrush

advapi32

RegOpenKeyA

Sections

.text
Size: - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ