55e49f1686bcf047781506fbcd157299030179b9148b9d8e58937a3384ed219f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

55e49f1686bcf047781506fbcd157299030179b9148b9d8e58937a3384ed219f
Size

236KB
MD5

a343a5d8f2b71862cb7426bc759a43f0
SHA1

132268d8889c422b355b787a3aa652139a99f5cc
SHA256

55e49f1686bcf047781506fbcd157299030179b9148b9d8e58937a3384ed219f
SHA512

1cfd98246b4ee27e8de84651692bdc880e4029de23df355a95aa11250a7f2bdac31028610901231c37cbe4ae5c196861cac6b6d343f8808849346831da0e778a
SSDEEP

3072:273PGWgsoyHCgqChEeCj2JoatSAro/x4JsaxttJreKNBEHe/uEzx+jIlZYxL3uuF:2zOWcsEt2JjtA/x4WaXtJi+JxoxjJ

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

55e49f1686bcf047781506fbcd157299030179b9148b9d8e58937a3384ed219f
.exe windows x86

1e6c59c8b6b20a3b77e767979576aaa2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

ord20280
ord18707
ord23366
ord63949
ord19674
ord65520
ord51460
ord59337
ord27276

hal

ord52331
ord24677

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 853B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 174B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ