2678f84344f576845e7fbdccd6867fbdbb5a545326923ac1af9738f5a419e841

Sharing

Copy URL Twitter E-mail

General

Target
2678f84344f576845e7fbdccd6867fbdbb5a545326923ac1af9738f5a419e841
Size 67KB
Sample221107-hmaetachd4
SHA256 2678f84344f576845e7fbdccd6867fbdbb5a545326923ac1af9738f5a419e841
MD5 053441e82e1aa51497f168acda383d30
SHA1 329cd34b46eb0d86ca396a466da6f18937e89ebc
SHA512 8ee5d7794eea9eb661b1b6906a258d71715eeac9dc0d7c2ac641a1ff205219c8f579d440f60f5d42b0b1f7ada15f2d481317a9956a2198189a67bcc5169e136c
SSDEEP 1536:j52PF87Jm2bBsv1y7e/ZjywfN4dKYdaCxpsyxpJZWYNQbObu6dgVnh:j52+QEBfS/VlCLRxp55QbIdg5h
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

File Explorer

2678f84344f576845e7fbdccd6867fbdbb5a545326923ac1af9738f5a419e841

.exe 67KB

2678f84344f576845e7fbdccd6867fbdbb5a545326923ac1af9738f5a419e841

IMPHASH ac525a01983d20605533bc430318094e
SHA256 2678f84344f576845e7fbdccd6867fbdbb5a545326923ac1af9738f5a419e841
MD5 053441e82e1aa51497f168acda383d30
SHA1 329cd34b46eb0d86ca396a466da6f18937e89ebc
SHA512 8ee5d7794eea9eb661b1b6906a258d71715eeac9dc0d7c2ac641a1ff205219c8f579d440f60f5d42b0b1f7ada15f2d481317a9956a2198189a67bcc5169e136c
SSDEEP 1536:j52PF87Jm2bBsv1y7e/ZjywfN4dKYdaCxpsyxpJZWYNQbObu6dgVnh:j52+QEBfS/VlCLRxp55QbIdg5h
MD5 SHA1 SHA512 SSDEEP

windows x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect

Minor OS version

Major OS version

Entry point

36620

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

384B

Virtual Size

340B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

384B

Virtual Size

284B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

640B

Virtual Size

524B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

996B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2678f84344f576845e7fbdccd6867fbdbb5a545326923ac1af9738f5a419e841

ntoskrnl.exe

hal