70defd98a8a0e7d6ae2c895b87bcf6deb234c062e2068b44c0ffb9501c23df86 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

70defd98a8a0e7d6ae2c895b87bcf6deb234c062e2068b44c0ffb9501c23df86
Size

156KB
MD5

15d1d6ac8f15f10b0bf6be1880b4ac5e
SHA1

8528b5fd768fdccb81d1a77f4b9484adfd5ab204
SHA256

70defd98a8a0e7d6ae2c895b87bcf6deb234c062e2068b44c0ffb9501c23df86
SHA512

587098e45716cf418f32249b555f19133e66d9dbf21994bb43c9a4dac1bc2dbc9bf80ffdc8cddb241c1eb39ff5e9ac8067b2d060c374843fdb13993553c8981c
SSDEEP

3072:MSzkNWQM7R3UxRA1j8nmqyOuRGr4jZ6wTrDiXUF/A3G5k5B:MS4NWQM7dUQHTOWbDrDiElq

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

70defd98a8a0e7d6ae2c895b87bcf6deb234c062e2068b44c0ffb9501c23df86
.dll windows x86

347c93757dd7572cdcec7d08024a1971

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetAsyncKeyState

advapi32

RegQueryValueExA

Sections

.text
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ