0808becc26081d63c4a77ceb33f22514bc33239ca31752b5ad74191b18b2fd3b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0808becc26081d63c4a77ceb33f22514bc33239ca31752b5ad74191b18b2fd3b
Size

1.7MB
MD5

8b31bf0fe9adf764a284dc52c9dd7488
SHA1

fff359592baf80b52a289ff1ad6e862b29040070
SHA256

0808becc26081d63c4a77ceb33f22514bc33239ca31752b5ad74191b18b2fd3b
SHA512

03930ddd3cad69e2c39a91afb6601c0764edc6246ad288d89d90c1f1e131a72fa802f9207fc513042bdf42ee59e8239683e1622ead8e71bf8af869f07dc8a531
SSDEEP

49152:mDW3em/Dqwd+FHqqJGReKzxNhEfyv/veHpEviY:mDyem/WfHqkGRdxEO/veHpPY

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

0808becc26081d63c4a77ceb33f22514bc33239ca31752b5ad74191b18b2fd3b
.exe windows x86

9b2f06aa91e7b770d54c5d5bd6698c8e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord5981

msvcrt

_snprintf

kernel32

GetTempPathA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

SetTimer

shell32

ShellExecuteA

ole32

CoCreateGuid

Sections

.text
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 300KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE