b88d90955072188160278aa74d36e13b83d3e2b7c39546dfeded8d2eb4ed92e8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b88d90955072188160278aa74d36e13b83d3e2b7c39546dfeded8d2eb4ed92e8
Size

124KB
MD5

0fe491d8d049099863c45c24ba160a20
SHA1

c23cc36b287c1010096d968c7d8bffa9249e45b0
SHA256

b88d90955072188160278aa74d36e13b83d3e2b7c39546dfeded8d2eb4ed92e8
SHA512

744a9cc86b1fd466523c295cac359cdbfbfc3a977990a03f70f996dfb6fdba2d53cedea360ed17c421ae28c4016fa5b96bf674da16c3fd40bb6631337d4135fb
SSDEEP

3072:f2FwNABorummh1Dbrk/mMAAV2ep90Z57Lbd:f2eN4orumwvk/R1p9iLd

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

b88d90955072188160278aa74d36e13b83d3e2b7c39546dfeded8d2eb4ed92e8
.dll windows x86

c8fa5ceae94b5fe04dd6809abc816e7c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetWindowThreadProcessId

advapi32

LookupPrivilegeValueA

Sections

.text
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 116KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ