d29ce37eef26ec270d62d218e1416f064d0c4466781eba002e436a27a8d59b69 | Triage

Sharing

General

Target

d29ce37eef26ec270d62d218e1416f064d0c4466781eba002e436a27a8d59b69
Size

364KB
MD5

960cee49affbb9cb83e3cd4f6e485939
SHA1

f6911a1293ceedb5cfff0a8425eab2c6b4f94b2b
SHA256

d29ce37eef26ec270d62d218e1416f064d0c4466781eba002e436a27a8d59b69
SHA512

a7a5de3401c04b2e77c7519599bd58e138b32ba8a4446683a4b48a20b44bc8b13c2bd16df216b26e1ba2ad44a0e17d4279846fbdd6bc3d9dd26bf25406bfe7a8
SSDEEP

6144:ppO/8yFRHc+onG7h8TgPYzTeB0DA5YRsTQ+oyQqsDCAcVhHR4O5Qt4:y/8y3NAGhgqYPeB0tG7Z/XQt4

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

d29ce37eef26ec270d62d218e1416f064d0c4466781eba002e436a27a8d59b69
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 357KB - Virtual size: 357KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ