63884664c64dd48bb6093f731d22c76baee947e2f69912e4abe4ade8288d12e7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

63884664c64dd48bb6093f731d22c76baee947e2f69912e4abe4ade8288d12e7
Size

1.3MB
MD5

a8277ffe3f915b414bd0f52b9098920d
SHA1

c8dc2b121ebaa22409acadf16eb39254077905a5
SHA256

63884664c64dd48bb6093f731d22c76baee947e2f69912e4abe4ade8288d12e7
SHA512

dde5b4a6b6d62ad48b7e7019abaf2e213b85c95046b050243ffe38f51638413f71ccc288456051e4083d1871967c999b4ef4e35220a67279904b6eabebba5f0d
SSDEEP

24576:yo5hlJ1DtRTGVigig0vDCw8MsGY1IlsrxXsXu6wd0H0ZTn/VS2k1fPhfPiuYck:yo5L3fgig0vfHyy4GuNd0Uh/g13Yck

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

63884664c64dd48bb6093f731d22c76baee947e2f69912e4abe4ade8288d12e7
.exe windows x86

e711f00f009793bce41d88147c70ff8a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaForEachVar

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 501KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 471KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE