6e886339df2d215c9eaa74c2ea31484c74f4d3a527929a80dda7f409ecd6e325 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6e886339df2d215c9eaa74c2ea31484c74f4d3a527929a80dda7f409ecd6e325
Size

1.4MB
MD5

a9327f40368e8de9b97a7d2e35e9f2f2
SHA1

709a3ec6749315d0a8853ced20ecf84049a2f6a3
SHA256

6e886339df2d215c9eaa74c2ea31484c74f4d3a527929a80dda7f409ecd6e325
SHA512

050c7847121cd7817d8a5c0b42d59ada03aea2d47c100875ef28679ce5b06a1287046b9a67ee6a03042e3fdfd763201c668382fb9da130e120817dc5c618ebed
SSDEEP

24576:mrZVshJgRlJTj5KRlKs4bkGUx5h/dfxOFAMXMk1NMw1Z3Vkl1jFvB:SZVshqxTj5KdAA5h/dfodbMw1ZCZj

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

6e886339df2d215c9eaa74c2ea31484c74f4d3a527929a80dda7f409ecd6e325
.exe windows x86

3eaa5ce8f4dd8fb075b7017d18e3545f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

advapi32

GetTokenInformation

shell32

SHGetFolderPathA

crypt32

CryptUnprotectData

user32

wsprintfW

Sections

.text
Size: - Virtual size: 506KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ