8aaf1d4fa00197c56797ac0d06ad425a3d79bb9898d72b702a73adb568ee337b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8aaf1d4fa00197c56797ac0d06ad425a3d79bb9898d72b702a73adb568ee337b
Size

1008KB
MD5

a1db89f4cd6524daf908e51df7a95620
SHA1

fb307354bdaf5daa920f82646dc4ce15b6bbb1ab
SHA256

8aaf1d4fa00197c56797ac0d06ad425a3d79bb9898d72b702a73adb568ee337b
SHA512

b944ecc5c81cd968ae150a7ca13e1c841c3cd46e878db1769307a359fbc069bed6383e212dcb56ee7d98c3100cb696888e40aba63c2030af5996b5a1b83c668b
SSDEEP

24576:MP94V2kqYHLRiOzu0YIShf32M+GoDgxZUg:42VlqTyu0lMf3rGkxug

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

8aaf1d4fa00197c56797ac0d06ad425a3d79bb9898d72b702a73adb568ee337b
.exe windows x86

58f1ab040df7fc196acdfa22bc705156

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord516

kernel32

GetFileType
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 984KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 996KB - Virtual size: 994KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ