532c62c8f99e40ca8407ae0b983ee8b29ed61dabad7b45bbc2593416512fe765 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

532c62c8f99e40ca8407ae0b983ee8b29ed61dabad7b45bbc2593416512fe765
Size

144KB
MD5

b928816c404e7ed1af3b9dc625349999
SHA1

35f263e6091f280f0187655580af6dbfc5ea70a6
SHA256

532c62c8f99e40ca8407ae0b983ee8b29ed61dabad7b45bbc2593416512fe765
SHA512

88cde2e26455f8599c7cdd7b53a6fb1b931bf5561c5e76aa836c44709785294b235089a83a815289dd81ed1784e470b1284bac7053af7d614931f4331c7f183e
SSDEEP

3072:K36vKaNxbVcYYSL92Nyie7w3kTiVTBxx15Q9HZK+72v:K/wqhN/e7wzT21ZH4

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

532c62c8f99e40ca8407ae0b983ee8b29ed61dabad7b45bbc2593416512fe765
.dll windows x86

d9153e08fc8f45a361df5b2e9ca96db5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

ReleaseDC

gdi32

Rectangle

advapi32

RegOpenKeyA

Sections

.text
Size: - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 136KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ