5ccebd8a33301fd4c43afe9113344cc693fe0b1eaab08dd877cbc62909ff75d3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ccebd8a33301fd4c43afe9113344cc693fe0b1eaab08dd877cbc62909ff75d3
Size

1.2MB
MD5

bb7f7a418e9b1554b1bf7d6bb6dd6895
SHA1

329bc921ded4a1ae7797d623a38181e23377a350
SHA256

5ccebd8a33301fd4c43afe9113344cc693fe0b1eaab08dd877cbc62909ff75d3
SHA512

b16e42c0e63ac1d83386a67ba21465fb9e8e380ae0b3a1a69282ecd5fd5629a6b21172933c0934ac22de0d67bc1d1179f1822268ae063940fc26755a347bd6d6
SSDEEP

24576:cys5DD269+3Hkc/rvh3hldueOrmWmDW56GvgCCjLJ/1F03sjyROM:tQF+3HkaLl82Wn6G0XlsceR

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

5ccebd8a33301fd4c43afe9113344cc693fe0b1eaab08dd877cbc62909ff75d3
.exe windows x86

6206cdd2188eba65cc3882e2bd8341bd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaLateMemCall

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE