8e4890f6300c3f0b0391e17d9fedff9d01b21cc9a61e3b0d3b812b465c45feb7 | Triage

Sharing

General

Target

8e4890f6300c3f0b0391e17d9fedff9d01b21cc9a61e3b0d3b812b465c45feb7
Size

152KB
MD5

5b84f57bc13e57d3749ef0bc8ec6d6ce
SHA1

a514c679ad0a9047218ba4d23e00cd533233e816
SHA256

8e4890f6300c3f0b0391e17d9fedff9d01b21cc9a61e3b0d3b812b465c45feb7
SHA512

f428d07a16c87f0c217ee9f8cc603a56f73da7abb032fb3bbffe95570eb9b87686030bfd03a6cdbd2ecb4703fe8e0f84e950482db9f43b9b1395c2221e9a4170
SSDEEP

3072:Xb8m+CtsQMuSfwKKgd/yKG8T5CHx0aLU3ELPm5jbPWg1vZ1ZYey+71ykY6zOzi:g3CEfwK68lCHBe1ug1vZ13Eaazi

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

8e4890f6300c3f0b0391e17d9fedff9d01b21cc9a61e3b0d3b812b465c45feb7
.dll windows x86

82e3d682a7472ff3c9a33738a1b6f581

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointer
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetWindowRect

advapi32

RegQueryValueExA

Sections

.text
Size: - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ