cff7ed0667b3a60e99e2b1842e8d7e34a01d04f3859adc7f3ed8834c1c33b68f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cff7ed0667b3a60e99e2b1842e8d7e34a01d04f3859adc7f3ed8834c1c33b68f
Size

804KB
MD5

d4a95c9c4ea95c8dfc599ee3fce77ece
SHA1

f7ca6a30b4baf7109269dcdbd5c202d4efd2ce8e
SHA256

cff7ed0667b3a60e99e2b1842e8d7e34a01d04f3859adc7f3ed8834c1c33b68f
SHA512

036439ffce61b8a5005b31b7edbeafa69bb2e490381e1639f0bd6219894daf4fd5606f257ff7135501b1c034b1872f7dc1f689338d88714743de7f3fdc500fef
SSDEEP

12288:vDTTtMOhafOkEtaIHfW2vSMRb7uSnZPi5qbLA5XG2gX1DD97MuubuilQ84XbPZ:7gfhqROmJbpnZPiIA5i5A9

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

cff7ed0667b3a60e99e2b1842e8d7e34a01d04f3859adc7f3ed8834c1c33b68f
.exe windows x86

27090a56e64fe7897c6f2492e77009b1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaAryMove

kernel32

FindResourceExW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 867KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 792KB - Virtual size: 790KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ