c29c57d5fb3f0477b8bd8df7091ff35c2eebdef9122b0f5afffe0ab763f511a4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c29c57d5fb3f0477b8bd8df7091ff35c2eebdef9122b0f5afffe0ab763f511a4
Size

164KB
MD5

075c3057e7cd866a98e1ee5f26396680
SHA1

4cfd0334e8a02a989a3268357e4ca8734270e478
SHA256

c29c57d5fb3f0477b8bd8df7091ff35c2eebdef9122b0f5afffe0ab763f511a4
SHA512

5e06273df964f100458317cfc2af3f26745055765e640bf65d2fb032a495debd0ad936d698fb65fefc43656b098f5450d932af31c7e4ad8317d634103f72d491
SSDEEP

3072:oy8cXo67nQuJUE5WpwJF5g3T/bE38HaUE2cACscWH5:oSo67QuJpzJLg3zbbHTE8C7

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

c29c57d5fb3f0477b8bd8df7091ff35c2eebdef9122b0f5afffe0ab763f511a4
.exe windows x86

594d96b7ee715a332190e1daa1466c87

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ShowWindow

comctl32

ord17

kernel32

GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

gdi32

CreateFontA

Sections

.text
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 160KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE