638b6449da59a51d2e72ce9b4e3f5fd2cb0fdc0162066dac8d169db7c61f200e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

638b6449da59a51d2e72ce9b4e3f5fd2cb0fdc0162066dac8d169db7c61f200e
Size

649KB
MD5

6266013a463e139af384b070e92f13b1
SHA1

f330cf289b32df0191da01adb33dffb72ccabfde
SHA256

638b6449da59a51d2e72ce9b4e3f5fd2cb0fdc0162066dac8d169db7c61f200e
SHA512

f345e57a24ff66b63b43b831daf00bc9abd86a86ac42cfa57cad15ab269ff6c973110cd765180acc09adb7f48051fb1259afd9483f70b0f45de2cc98534d639d
SSDEEP

12288:M8PurGR4+g3vcR1u9tuHGzpB7whc3EspoCdwt6Ez3lzhxTRonINDFSoA:M8W6DgfjF7h0SdOBzVzjSINxS/

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

638b6449da59a51d2e72ce9b4e3f5fd2cb0fdc0162066dac8d169db7c61f200e
.exe windows x86

cc4aac6e8b51ddc13a96a79d46d6a42e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxW

kernel32

LoadResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

gdi32

SetTextColor

Sections

.text
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 642B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 608KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 646KB - Virtual size: 645KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ