45ce253a5152be7270159a8ff41aaeaac5f144f7f7992ced3c9c829034422836 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

45ce253a5152be7270159a8ff41aaeaac5f144f7f7992ced3c9c829034422836
Size

188KB
MD5

62464244b996e2560d5a3055c999cac6
SHA1

fbfd6ca1b7611b0a5eb6997a11a4af40efaeb762
SHA256

45ce253a5152be7270159a8ff41aaeaac5f144f7f7992ced3c9c829034422836
SHA512

7d058eee0313cd97a8a3b11844f1537b35bda289c23bf9e37dbb7d1bd75ded5228ccde2f543737fc14c17a9836d416f89f9f3a4380f5e021f031f9a2c930fcac
SSDEEP

1536:o2bQWfFPDExr3vQu4SSy3zFegkweJP2quGL1stZiA5be:NbQWfKxLDJegkweJBuGL1Wn5

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

45ce253a5152be7270159a8ff41aaeaac5f144f7f7992ced3c9c829034422836
.exe windows x86

ec81786d4b1f6d24da746d7bbe292cbc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetModuleHandleA
GetProcAddress
VirtualProtect

advapi32

RegQueryValueExA

shlwapi

SHDeleteKeyA

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ