8e922d349d0b2a1acc7f697a449636f34a2213405475107d3d959c0756bdaa87 | Triage

Sharing

General

Target

8e922d349d0b2a1acc7f697a449636f34a2213405475107d3d959c0756bdaa87
Size

5.1MB
MD5

46ef05d85c986b4a9ff777e1a1d6c1bb
SHA1

5b9edae5e85e5135593388801b54489f3715ce32
SHA256

8e922d349d0b2a1acc7f697a449636f34a2213405475107d3d959c0756bdaa87
SHA512

adfb61766e26f48a6737f4828b78f91aa07ec51a83ffb7fb9aea97245e05563b3aaf1dd7654c2ca192193204dce807af2466f089152bd99c33d43ee4901f5d57
SSDEEP

98304:Elh/b1VB2qTTJxF9Gzhm/1hsB9l1q6/624mA4KCDMgehe6lHyfga:0hDfbEzk/1hKl1ZQqfg

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

8e922d349d0b2a1acc7f697a449636f34a2213405475107d3d959c0756bdaa87
.exe windows x86

817cbcedeab351a0220374084fba3bf4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellAboutW

msvcrt

__CxxFrameHandler

advapi32

RegOpenKeyExA

kernel32

GetModuleHandleA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

gdi32

SetBkColor

user32

GetMenu
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ