8a252c6eca2afca67aa404490344535261a86939d9337aa001304c830194c20e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8a252c6eca2afca67aa404490344535261a86939d9337aa001304c830194c20e
Size

424KB
MD5

a96f9448a35fc99b599e958966a80a22
SHA1

78b8166b15a9a61f262b54e55de02b1547c66687
SHA256

8a252c6eca2afca67aa404490344535261a86939d9337aa001304c830194c20e
SHA512

c67c9e61838c1e0b487d3f6824d21e00df18328dc2ead621a3fbfcbe9eb1db83befb10058c024a5850194bdd3b98e4f9243263660fa9999b4846c889e4abc167
SSDEEP

6144:nJqr5L30zzjsKePwxXuj4eEiWFeFID2wM/1KgAT:nJ030zfsKeIM9EiWYFSwKgA

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

8a252c6eca2afca67aa404490344535261a86939d9337aa001304c830194c20e
.exe windows x86

11cbdfb47fdc9152560598c88ea044f0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

LoadCursorA
MessageBoxA

advapi32

RegEnumKeyExA

ole32

CoTaskMemRealloc

oleaut32

SysStringLen

gdi32

GetStockObject

ntdll

RtlFreeHeap

Sections

.text
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 243KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 255KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ