1909194999a5013730597cc0e4b575d3b3accf03a982a91305c3f1ff18940e61 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1909194999a5013730597cc0e4b575d3b3accf03a982a91305c3f1ff18940e61
Size

152KB
MD5

4e4b0267a4a43d1cd323578531108000
SHA1

d251a19997655ec3275b101d537eadc6a1b32994
SHA256

1909194999a5013730597cc0e4b575d3b3accf03a982a91305c3f1ff18940e61
SHA512

dd7ef346c120ba8a0b5733298849c14a24fdd89b81d008126f1fe7f2f6b33095ed448e3301d881e56081901f1c904e60c61f56609a49e5ef9454571f891e0d41
SSDEEP

3072:B2Bo+O4Cv5rH7Ab19GNrtEVbVVVVs/u2R+rmQro4QamEXdo+pG:B2BoF4CRrHk7qr6ZFit+rRdQEJG

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

1909194999a5013730597cc0e4b575d3b3accf03a982a91305c3f1ff18940e61
.dll windows x86

63ef7f0ad93144d074e2b7fa9760df6f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetWindowThreadProcessId

kernel32

Beep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

winmm

timeGetTime

advapi32

LookupPrivilegeValueA

msvcrt

_ftol

Exports

Exports

SetHook
unhook
��y?e_CRC

Sections

.text
Size: - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ