fd54769de491cb66ccb1efd7d5de0fdf1d31481c2c6a91f12d81ee80c4eaa4ca | Triage

Sharing

General

Target

fd54769de491cb66ccb1efd7d5de0fdf1d31481c2c6a91f12d81ee80c4eaa4ca
Size

124KB
MD5

08e2440c7c6b73914b43e99f7fea3800
SHA1

ef015e08a5e1c028cb99461b1e31ce400f35c00d
SHA256

fd54769de491cb66ccb1efd7d5de0fdf1d31481c2c6a91f12d81ee80c4eaa4ca
SHA512

5b89424b937e7e301a3623d0cc114604205cd97ebac9fb2cddbc3de1562fbb23edebed75ba50b603812e0ac4f22302a38aad84bb749d46c1404998abc3f2b20c
SSDEEP

3072:hq5ppXQ9gWZsq4GkAldShgCU9T46mpXtTcEC9WYzoJ:hgppXQ9l+q4GFl0hy9T4vpXxNCAYA

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

fd54769de491cb66ccb1efd7d5de0fdf1d31481c2c6a91f12d81ee80c4eaa4ca
.dll windows x86

fa67272c1cd7ed84c0f14d74dba545db

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

FindWindowA

Sections

.text
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp2
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ