d7ebca376c7dac4110e6cdf2578af0a903b81b23293c263db798df90df55ce98 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d7ebca376c7dac4110e6cdf2578af0a903b81b23293c263db798df90df55ce98
Size

1.4MB
MD5

18afb94e106183c74dfe321a15893361
SHA1

87ff062c6a69562727795e6d13c0b29d22eafe9e
SHA256

d7ebca376c7dac4110e6cdf2578af0a903b81b23293c263db798df90df55ce98
SHA512

4c4fb73f5cbf1564e8768ffc1bc49f0f9eb9f2dc518d0f41940edaa13c849eaebe1d7c56925f51d8bec850e708f1e5668d5239988ccc855403a5de5b52ac3191
SSDEEP

24576:Yo5/Sc9WXDqMmLUPe0gyh2U4676v8mdzufcrQNKZX4Xve9lHwAMtzDzEiIZ5Y:YokUWXDFmueFy2U46O8mdzufcrQg2XvZ

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

d7ebca376c7dac4110e6cdf2578af0a903b81b23293c263db798df90df55ce98
.exe windows x86

e0896edcd3ab418b099d54b6dbc31bed

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_adj_fpatan

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 505KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 713KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE