0c95c76b063c6b731446402b574ba8b6d61f81c12206a709f84292fd2d527688 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0c95c76b063c6b731446402b574ba8b6d61f81c12206a709f84292fd2d527688
Size

1.2MB
MD5

840207f2e610137a192fa06f45b45160
SHA1

17bafe8967375b83fadc8f1322d61464e11e4009
SHA256

0c95c76b063c6b731446402b574ba8b6d61f81c12206a709f84292fd2d527688
SHA512

f42c69c2323b42cf605ca7a0825b4d85f0d954569ed341f0bdb69d70b32c7ff1fe04d80db0bf0e78171dbae5fc71cd03856fb5acc07464ab04d9023fbcd64ced
SSDEEP

12288:NA1sB8Vl4oh7Rxd7OXcD0WZ1ZdmwsVSQuvo8OyaFZZjE:y1fVCWx0sAWZ1ZjN5A8OywjE

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

0c95c76b063c6b731446402b574ba8b6d61f81c12206a709f84292fd2d527688
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 721KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 327KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE