c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a | Triage

Sharing

General

Target

c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a
Size

2.7MB
MD5

08380f41a474b4827ba6293b0c618b48
SHA1

cb6468f7ac112afe3f6e4be4d2ba29ea8ca3d34b
SHA256

c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a
SHA512

4f91437da97b01e249221b5935cff16e19dec47494b8745a5c1810f639adc53848793826f17f87986e4e8be702e0606c96547e3cdba865a6a8b788635bebe821
SSDEEP

49152:jVvKYKnMuK0CcQh4Mgb1Iz4Mzd/J2ivWfHSHV8n3jTv4w2waARa1fWd:YauNc4bK4u/J2pHwV83jTww8AJd

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

c2d2cfb91f5ea8e47102600dec0d9f65eba08e993c87767af589746e1116763a
.exe windows x86

3a05251332bac4fe8c0ab3cb17a589fd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
HeapCreate
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 424KB - Virtual size: 423KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ