1f8192c00e86cf62f3f48fcd3a8b6fea985afebd3379be0491af791074ab5094 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1f8192c00e86cf62f3f48fcd3a8b6fea985afebd3379be0491af791074ab5094
Size

156KB
MD5

83b5ccf1eb3ce8edc87a17eb7e27c0d5
SHA1

3f8e5629837a13d152fab6984f3892a6b48b59e1
SHA256

1f8192c00e86cf62f3f48fcd3a8b6fea985afebd3379be0491af791074ab5094
SHA512

d0f1c62db1a7177c6d5d1289faf64981849a87c7afb6377fda2bfe4d65b9366e406762ed0ec32a529a560b5a1fae29fcd68ca3c4674edcf91581f3d7280e51e2
SSDEEP

3072:eTo5WVxWIZIhM6R48xTY4qdgfjBKLzjIyi6aFBGF0XL2pP8+Oo1aGN5C:gXWVhM62mJQgfd/D6WBlHlo0

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

1f8192c00e86cf62f3f48fcd3a8b6fea985afebd3379be0491af791074ab5094
.dll windows x86

f618cfc7d0655b7ad51fe9147c04c82f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentStrings
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetCursorPos

advapi32

RegQueryValueExA

Sections

.text
Size: - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ