70f8ed8065a0ffc2efe1fed1f8c0bda9416b524885c7a7b9721b06dc41fce13f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

70f8ed8065a0ffc2efe1fed1f8c0bda9416b524885c7a7b9721b06dc41fce13f
Size

568KB
MD5

8f6a2dbd38c4f74438fba29e486d5f19
SHA1

447371cf2bd7901205cb97b01ce24cdff7d63d30
SHA256

70f8ed8065a0ffc2efe1fed1f8c0bda9416b524885c7a7b9721b06dc41fce13f
SHA512

e80f3336f43a4c1dd2933cf8e988838cb63ab8dda699335b688afe327d72ca96068011fbc0b656343efcbdb6d0e062b1fd786d2b15b71ec4856eb58716739d95
SSDEEP

12288:d+bSe3MoFrxpks9I/djsp5/vV/oM+eKQq0sNS7p/5RimxC/vLmwd5OozjG:pEhPkgIljsqYBx7p/5R/xez+EjG

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

70f8ed8065a0ffc2efe1fed1f8c0bda9416b524885c7a7b9721b06dc41fce13f
.exe windows x86

e366a11904ead6eea720e90eaa31612d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SuspendThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MsgWaitForMultipleObjects

shell32

ShellExecuteA

psapi

GetMappedFileNameA

shlwapi

PathFindFileNameA

msvcrt

_ftol

Sections

.text
Size: - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 511KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 567KB - Virtual size: 567KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE