ffaf63eca8ed94832126b27787e549cb7dd32785fa1690308c434e59a28fe6f1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffaf63eca8ed94832126b27787e549cb7dd32785fa1690308c434e59a28fe6f1
Size

684KB
MD5

9a0c508b68ba67f19c26eece1adef50e
SHA1

38e593c0809892f9f6249510d9275162b04f7109
SHA256

ffaf63eca8ed94832126b27787e549cb7dd32785fa1690308c434e59a28fe6f1
SHA512

36ca7f0521c5da0bfb0bb0e7c0ff5e01102a24d1c0703b38591c3464e8d172e70a89dc8222bd67ca9df4f849b53f83d213b23df5ee608379bfeebb75108189ca
SSDEEP

12288:4vTBO8kntZzRlarEYjfqRH5lBJZw+V6wggR8lOSHhonVZJaM:6TBODllKEEqZ5lBJZbd8lph8v/

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

ffaf63eca8ed94832126b27787e549cb7dd32785fa1690308c434e59a28fe6f1
.exe windows x86

7dff3d396fb651d92cc75a81cbee6cdc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaStrCopy

kernel32

FindResourceExA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

wsprintfW

Sections

.text
Size: - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 646KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 672KB - Virtual size: 669KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ