14baeacfdb1463acb37cd1d923f1f8b02fc58b73c10690b06d3ad0fab272d6e4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14baeacfdb1463acb37cd1d923f1f8b02fc58b73c10690b06d3ad0fab272d6e4
Size

352KB
MD5

69d6cd56f4f8ed304494c809ad800b50
SHA1

6c275973e168f99bb182017c56c7c04c0879930d
SHA256

14baeacfdb1463acb37cd1d923f1f8b02fc58b73c10690b06d3ad0fab272d6e4
SHA512

7a9158b4c57bd67a13fe67f0b970c867b2ec4ceed1dd832d334544e0d071d6aebca0a60deef358c3b58933405c92b6cf8c43590b42a7e8fb123e393bf2dade41
SSDEEP

6144:ZkzrcsXUQvtWCCCFWqgcD5aruK/VA8s7+AzlWGjxfJ9SB8Sg19kA4tD:ZkzgtI4C4qg+5PiP4pjxfJ9M5Ao

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

14baeacfdb1463acb37cd1d923f1f8b02fc58b73c10690b06d3ad0fab272d6e4
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 608KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 402KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 824KB - Virtual size: 824KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE