8792798a0b56f150d76205bb27f742179117f10e2c72c07b38438f9dc05d39b9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8792798a0b56f150d76205bb27f742179117f10e2c72c07b38438f9dc05d39b9
Size

141KB
MD5

3fe52715147a8f9c97afc95e6460a91b
SHA1

82641708bde7c7e48b3a7ef7ff9c07114d8292a2
SHA256

8792798a0b56f150d76205bb27f742179117f10e2c72c07b38438f9dc05d39b9
SHA512

4e8daf884d4c740081d0f6baaf8afa18d46a1afb9b07a60aed689a1830812d9971617c6aa8084ed9d79afb83cb4ba40b5784184df1aa8caf0527c483c4004a71
SSDEEP

3072:Ro+BC3K5eqAXtQTzzqVWOK78zkpvmD4LLL57eAA0mvmqmvxuC:yK7AXtQ/OIFwO+D4fF7kZMu

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

8792798a0b56f150d76205bb27f742179117f10e2c72c07b38438f9dc05d39b9
.exe windows x86

465d26967af1346f094e36253f9c8f2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtSetInformationFile

kernel32

WaitForSingleObject
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ