f8fe685cf6973c5019a8c73fed7ad40128a1ae5ae60675a536914ded4a8a005d | Triage

Sharing

General

Target

f8fe685cf6973c5019a8c73fed7ad40128a1ae5ae60675a536914ded4a8a005d
Size

148KB
MD5

82d18d420735432fd14d17dd1f6a5960
SHA1

7d6a9134078f42797cc56c4eb9d125cdafa27a59
SHA256

f8fe685cf6973c5019a8c73fed7ad40128a1ae5ae60675a536914ded4a8a005d
SHA512

876b2a4fd1157e055f8cdaf144438db4a3b0f06fbdc5f3300fd425d30db5cab2b96ec610f06dab1889f3153c1d4e50656289d1b5e8677ed899a5ea113536ad73
SSDEEP

3072:DEDAwqfR6W3oY0kUlAlp1ODjmzw12TdHc6P8+5wmNG+7tPqw:DE1w3OlOI3lG860+HSw

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

f8fe685cf6973c5019a8c73fed7ad40128a1ae5ae60675a536914ded4a8a005d
.dll windows x86

50613874316b74dc7f321236cb755963

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

FindWindowA

advapi32

RegCloseKey

Sections

.text
Size: - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ