95444248836ced3c219e2b484607dae926346af59fa094addc598664f1271900 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95444248836ced3c219e2b484607dae926346af59fa094addc598664f1271900
Size

144KB
MD5

72fb0ef265e86aad32e723a4b4a82169
SHA1

b19d077bbef5a2bfaa23774213d06fe5636c158c
SHA256

95444248836ced3c219e2b484607dae926346af59fa094addc598664f1271900
SHA512

ba717c20a08ef7dfd5b6e4f79035d0aaee70e99ae1ade64ffc64bd2e0f59f751f20aa2edae0665b12e69629b2a1e9771355c8cc89c271f4f7f1a5f6981df9a34
SSDEEP

3072:2u5fszrFHfNy1o4dTONFRUBLY32nIRO85uq0+1mVSLNxdHAe4X:KzZNyy4dTONF+BSRt5uq0+11LNxdc

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

95444248836ced3c219e2b484607dae926346af59fa094addc598664f1271900
.dll windows x86

dbab97ff3ebe3d871803facb9d3dda98

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetAsyncKeyState

gdi32

CreateFontA

advapi32

RegOpenKeyA

Sections

.text
Size: - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ