16615c5ae766c0e5da84b21c6e8e621bcf8b840f3c751e85a16f4de128985c7f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16615c5ae766c0e5da84b21c6e8e621bcf8b840f3c751e85a16f4de128985c7f
Size

804KB
MD5

0b3c737ec084ef78cf39079687522bf0
SHA1

9c0a812eef8319f86c091a4c46071b8e68fac4d1
SHA256

16615c5ae766c0e5da84b21c6e8e621bcf8b840f3c751e85a16f4de128985c7f
SHA512

ddd962405057796d238f0c0f707c3774fd1444cd1009db830941644247b94c6c6b28bceb1c5c86bf634b69b29814777e2f67c93a722d6425a9faa3bdb5cee8dc
SSDEEP

12288:Kei6cBIzXj26BhZ9cvNZcgFvBD0anN9kOeIInVtP3oJA9oAXX3tkyQLs7VtBg:a6gM26HZ2Sa8On83voWXWycs5zg

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

16615c5ae766c0e5da84b21c6e8e621bcf8b840f3c751e85a16f4de128985c7f
.exe windows x86

05323e50f5c8b46dd881113c6376c32a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord595

kernel32

HeapCreate
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 737KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 792KB - Virtual size: 791KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ