ddc2bdeba010849db93a76d042db74d311c2863e3887b0522c31af5246f01826 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ddc2bdeba010849db93a76d042db74d311c2863e3887b0522c31af5246f01826
Size

1.4MB
MD5

deff14023eb246e1cb0ca4c49e7925e2
SHA1

fdfc8aa85224fa5f35ce12a473a319ee05ef8056
SHA256

ddc2bdeba010849db93a76d042db74d311c2863e3887b0522c31af5246f01826
SHA512

2f65fd79491a209d5ee8bca91460913b165d71ecd38934aa309310366d4c067e2afe69c2e3de7273fcd0291ed4cd115a762ff9f09c4e792931ee537502419c02
SSDEEP

24576:oUjatLwHgHmB2dDsh0PNLgesaMDzSlKYdxDNXGR/IZcKk7X7Or8jQaH:oGbIdDtNLgesr3mKCxxXQIZkZ

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

ddc2bdeba010849db93a76d042db74d311c2863e3887b0522c31af5246f01826
.exe windows x86

22d9124eeff2be1d351012c8e0b4a5e8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

lstrlenA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

advapi32

RegOpenKeyExA

Sections

.text
Size: - Virtual size: 556B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE