06c1403cc42f1255c3bd0acfb74e7a7f7e6322ae25e074e091c49881b73c00a9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06c1403cc42f1255c3bd0acfb74e7a7f7e6322ae25e074e091c49881b73c00a9
Size

136KB
MD5

05ae9302d20ac77213d51ed220ce7550
SHA1

414c7c23e007d19c4f46d7956b48e402b3629196
SHA256

06c1403cc42f1255c3bd0acfb74e7a7f7e6322ae25e074e091c49881b73c00a9
SHA512

9e6ab2398ae40343b71c4d482019e4f183e175549671cb4ca0a4f624463ca59270107ec7433b6346db66a62dc494eba07fb5d1222cd915ddfadd6cb14888ec19
SSDEEP

3072:H1ZiDbaujEWNneLT+xVRu7AWcq71orBnKr+RJCPxJaXoTWNne:HubuWFeLyVRuLcqBorUrbxJrWFe

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

06c1403cc42f1255c3bd0acfb74e7a7f7e6322ae25e074e091c49881b73c00a9
.exe windows x86

ea6e8d8f6c4055c3d2d028118d5f8ec9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

wsprintfA
MessageBoxA

advapi32

OpenProcessToken

shell32

ShellExecuteA

msvcrt

_controlfp

ws2_32

recv

wininet

FindNextUrlCacheEntryA

shlwapi

SHDeleteKeyA

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ