ac130ec037952d3c4f473cab1d95274dde360d48f329241be270fa4a4b61ab13 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac130ec037952d3c4f473cab1d95274dde360d48f329241be270fa4a4b61ab13
Size

319KB
MD5

359aee1f15acbbb02f107ebc20ef683a
SHA1

4a541459ee0f0e5a4591d6a6a51709cb6f707dc1
SHA256

ac130ec037952d3c4f473cab1d95274dde360d48f329241be270fa4a4b61ab13
SHA512

5528678f9d0617c342095ad2bfa82fe25a92cc2450e5437a74a1ee015b3af2ee0fbad7f8263fe714a3189922389fc9927fcb1c5232d37fdf27212d4c6c5b37c0
SSDEEP

6144:4OXVGZhneMOs4tzN474pJw28p/TMuFY9E0yZT3pTJs:7VGes4tzNFz8t4YtZT5TJs

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

ac130ec037952d3c4f473cab1d95274dde360d48f329241be270fa4a4b61ab13
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 519KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 292KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ