704f02d150d6319a1a284f3d6d1da98f8cc1c9049d2304d47e7587b4b88ffa4f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

704f02d150d6319a1a284f3d6d1da98f8cc1c9049d2304d47e7587b4b88ffa4f
Size

44KB
MD5

7982f6d316433be87315c797758e07d0
SHA1

9e4f0d3ca4f2ebf598937808ba7ee730cbb8a3ed
SHA256

704f02d150d6319a1a284f3d6d1da98f8cc1c9049d2304d47e7587b4b88ffa4f
SHA512

2a2bee963fe5b8c9f9b0412ed2bdb992161e9e92530a65894a29cb03df0bc2cca0ff1b879d7031ee4436610ba9749ffad30cbb03f6b41ac5ab53535816746354
SSDEEP

768:iyt1UXhIQLjdcFXvZnI2N7LQqnGP5Pv1mT8x3uAh8n90e/y:Jt1UXjXdcFXvZnI0LxnAPNmwZTg0e

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

704f02d150d6319a1a284f3d6d1da98f8cc1c9049d2304d47e7587b4b88ffa4f
.dll windows x86

a2f121ffc535593785c5fe15ebf1f073

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

kernel32

GetCurrentProcessId
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

EnumWindows

msvcrt

_adjust_fdiv

Sections

.text
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 502B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 264B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ