72b8c2a2721a5d8a1d107cf4379e807c5c5e15baaa33ba51502a2d223f595b78 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

72b8c2a2721a5d8a1d107cf4379e807c5c5e15baaa33ba51502a2d223f595b78
Size

1.8MB
MD5

0fee0d9c820e9106c625010966c9db19
SHA1

773494d755b64b52913f06c933526e30d1d6d5ca
SHA256

72b8c2a2721a5d8a1d107cf4379e807c5c5e15baaa33ba51502a2d223f595b78
SHA512

0c3a4c56c65aaee77235b30788e1446b004fd7bd17bd4410c71b17a477b51132f30302d48e964938e6aff3b12bdb6f5afebe200c4781cfad2b1202a82f7c8b3e
SSDEEP

49152:Ho3ei/UXpb97pI0PmAL+KuBOmf/TtpoD9zen/cZi:Hou3XpJ7e0PmwvGb/h/cZ

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

72b8c2a2721a5d8a1d107cf4379e807c5c5e15baaa33ba51502a2d223f595b78
.exe windows x86

38210e18de1d63aa9eda259a27e2f849

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarCmpGe

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 381KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE