900dcca9b90d1aac593da65521fd65c4e0cd104bbbeffc03bb4fad9ccfc0e77a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

900dcca9b90d1aac593da65521fd65c4e0cd104bbbeffc03bb4fad9ccfc0e77a
Size

110KB
MD5

a01677e923463a7df8943041d6a93040
SHA1

fa5574887cb4b8131835fe330e8935d2db44ca4f
SHA256

900dcca9b90d1aac593da65521fd65c4e0cd104bbbeffc03bb4fad9ccfc0e77a
SHA512

0e281b2fbb01d2098a8d051dd62a4d2d42ab8b7ae3e9e634029169014678f59e2e45acd8ba68e9c9d17a295bcccc6f37e6f70c6721e0b3a14bfe00b3a7663595
SSDEEP

3072:DzMRgWnGO8WziGt7NHewW34qKjT8+CRMd9b8Gq5:DwFGwWGf3qj+wMd9AR

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

900dcca9b90d1aac593da65521fd65c4e0cd104bbbeffc03bb4fad9ccfc0e77a
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 282KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp1
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ