7c3a055a28e49d10815df4079f6576451356e013d12113c19e03f32c5923e3f8 | Triage

Sharing

General

Target

7c3a055a28e49d10815df4079f6576451356e013d12113c19e03f32c5923e3f8
Size

5.7MB
MD5

10d95152032b35c3861c2f1b3fb701fc
SHA1

1f99925ed6de536af3ee86ebf0794b518f24ca2f
SHA256

7c3a055a28e49d10815df4079f6576451356e013d12113c19e03f32c5923e3f8
SHA512

2f234cce171ae6f6341e2740237553fe2b30f66bb7d5e7707159d437c0e129273ffa70317b74c7136f2864fb75f00f94f88854c423690d78fab3242159eece7a
SSDEEP

98304:k5uRVDojz+nDoihvKbKnLwsSZleNDP+oBlN05/te/3b/w/424y7Xbjn:kEXnDBhvuScsu87+oBl+JA3b/I1fjn

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

7c3a055a28e49d10815df4079f6576451356e013d12113c19e03f32c5923e3f8
.exe windows x86

b0a3c6817c3bc91463a81826e090915c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetDC
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

gdi32

DeleteObject

shlwapi

PathFindExtensionW

gdiplus

GdipSaveImageToFile

wininet

InternetWriteFile

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 533KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ