6b00d13e8e029aadb3bb2ce860cde0674fdf5240a5804bfb4aae6913a2ae5cc8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6b00d13e8e029aadb3bb2ce860cde0674fdf5240a5804bfb4aae6913a2ae5cc8
Size

515KB
MD5

33b33cc7cbee7491ae875843b15f3940
SHA1

b3f2e6b6aa4ee6969628c2ba2ac515c79671629d
SHA256

6b00d13e8e029aadb3bb2ce860cde0674fdf5240a5804bfb4aae6913a2ae5cc8
SHA512

af04fb95c6ec46989c439f77841134ccb18c9da5c460740ab903858594d6171d9aa85d9a057bacf9b55358b65a97199f490b99ed3f2d74dd20a4cfe20d2b0f45
SSDEEP

12288:6LvIambI9jZtVb8ZzLKIh5bbOAJzAmZTralHMN:6LwamU9dsLNl6aalHG

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

6b00d13e8e029aadb3bb2ce860cde0674fdf5240a5804bfb4aae6913a2ae5cc8
.exe windows x86

b0994211a282e0a5ea44aa2eaee7dc80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RaiseException
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

ole32

OleInitialize

oleaut32

SafeArrayCreate

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 348KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 445KB - Virtual size: 444KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ