840f3dd4c54e93d0c447bdafa5ab3bae87295574025b015b1255112a9b6eff96 | Triage

Sharing

General

Target

840f3dd4c54e93d0c447bdafa5ab3bae87295574025b015b1255112a9b6eff96
Size

296KB
MD5

65244d56fc88906158917159c5aee1a7
SHA1

11e933f6c164d10d9af7cc22094d58d4f117ff78
SHA256

840f3dd4c54e93d0c447bdafa5ab3bae87295574025b015b1255112a9b6eff96
SHA512

3298bce7c871b01455a4055ecf70e6bb206b67af1922be3017c70aa8b99df9185f5f94b5ae0d7ff780587cc8b0f17c1cdbef8cfac8a3d3de5a6445b7bc71b816
SSDEEP

6144:Xba1LLje7k6umXIa05ns2hCSazwN2At9d1zJAAo79OopVwSvINW:XbalLjqk/mXIa05rhtBhPVAh9Ognv0

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

840f3dd4c54e93d0c447bdafa5ab3bae87295574025b015b1255112a9b6eff96
.exe windows x86

9fac5daa6c54cf1a14a7065b5b473918

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord598

kernel32

GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 518KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 284KB - Virtual size: 281KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ