a6a5047725883458e843b28f563a0fc88a13d0a676889a5b58ed7d7e920cb35a | Triage

Sharing

General

Target

a6a5047725883458e843b28f563a0fc88a13d0a676889a5b58ed7d7e920cb35a
Size

83KB
MD5

73f5d5a5e75dc4a5968dd509556ad430
SHA1

12a1d8a8adb8fd1f0e7b86965203bf235ca4be52
SHA256

a6a5047725883458e843b28f563a0fc88a13d0a676889a5b58ed7d7e920cb35a
SHA512

20e07a854f02d7a3f3868d4e0d6cdc6b9797dcd5326ca9197bb1af5523478aebd58eb1eb4912b2cf749476ae0fe77fe04ba9e49f694aabe64eb3b9791a0fd422
SSDEEP

1536:xqeA8c2MuiVrzmfAwAP/NuoTxmMoWlpr/QBSg3OJRIE3sYoS9akfbB4zWq0GmuhQ:xlA8muiuAwi/NtTxmypr/ySSY1sSobx0

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

a6a5047725883458e843b28f563a0fc88a13d0a676889a5b58ed7d7e920cb35a
.dll windows x86

2387485255c7a4f0afa87d352dbafc35

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetAsyncKeyState

msvcr90

_onexit

Sections

.text
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 686B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ