a51681a4fb74d9a2539831abe4d3d6726a5d535655921369ac5376ae44c4c348 | Triage

Sharing

General

Target

a51681a4fb74d9a2539831abe4d3d6726a5d535655921369ac5376ae44c4c348
Size

4.9MB
MD5

34b1371980d5f9a976c2507bedac475a
SHA1

d76d0302e17b11de1937b7a34898341b5b6dc03a
SHA256

a51681a4fb74d9a2539831abe4d3d6726a5d535655921369ac5376ae44c4c348
SHA512

77a8e338807e6677d081aebb66febf550ee3e080ea322d9d8be3e406abc1110987e496b76dfbd71c898c0bef10e5db5c7ea313b8709558601ee53af0f50e39b2
SSDEEP

3072:dob7cSQ/Et1jmiKbg9s/YwVSkJ/oi2Vbij6MXBF4wYHXVbAGta:sgSQ/syfbasHAkhoit6MXBF0U

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

a51681a4fb74d9a2539831abe4d3d6726a5d535655921369ac5376ae44c4c348
.exe windows x86

791f421b7004cf27f33dbe5d800b3e19

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord389

msvcrt

_onexit

kernel32

FindClose
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

OpenDesktopA
MessageBoxA

shell32

SHGetSpecialFolderPathA

psapi

EnumProcessModules

Sections

.text
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ