5be70441638ed2e6636805b1707e86a7e5695b1f5e01f3638e1b6cabe0881fff | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5be70441638ed2e6636805b1707e86a7e5695b1f5e01f3638e1b6cabe0881fff
Size

156KB
MD5

4b0db94a94d8cddd029c448fc1db4300
SHA1

2e9d2eba5173f7a937edd0e88e057a175650d2b2
SHA256

5be70441638ed2e6636805b1707e86a7e5695b1f5e01f3638e1b6cabe0881fff
SHA512

46d493ff7f448fd0dd6b0a574d37f5e52455e92a9bca0923bcea2839509d26cd98b0617a7909ce9ad303474ab5971c0f6296afbeda3b321bdf039d9a5097b272
SSDEEP

3072:AK73CA1efidfTeHPPkWAxs5plwNuGJrOcy7SoHWUzy2CWOxX5hLAtbG:dbeH38q58Nxrdhijy2CRxX5RY

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

5be70441638ed2e6636805b1707e86a7e5695b1f5e01f3638e1b6cabe0881fff
.dll windows x86

4d6096a5debe909f6df29ff48fea4f94

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsProcessorFeaturePresent
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetCursorPos

advapi32

RegQueryValueExA

Sections

.text
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ