300d74f6a375d746de0cec6b3c06d033ca48c10d82adc945d3448678c9517511 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

300d74f6a375d746de0cec6b3c06d033ca48c10d82adc945d3448678c9517511
Size

668KB
MD5

602abc6a0a7310af5dc22db673dcdbc2
SHA1

d39ae92c2ed9927417150d120b639cd9c7e63342
SHA256

300d74f6a375d746de0cec6b3c06d033ca48c10d82adc945d3448678c9517511
SHA512

d46888176f2cc945918152272f5caa5b37b155109e2c927c9120780eca80b7dfc283cc1d6d9cdf88ec55ac375e3db0c2fec0669b84f10b16987b1a1d2b19087c
SSDEEP

12288:lgESTinivdMi9XWxb0Ixev1Hxpc8tjy/Ng0BZysE4ZmYiVHYRsfeNHeeRsiAxbB7:lgfWniiBxbO1RDs/m4w2IPCRsWReemio

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

300d74f6a375d746de0cec6b3c06d033ca48c10d82adc945d3448678c9517511
.exe windows x86

e4c7461fc3f752a4d1c0368a9ba336e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaFreeStrList

kernel32

CompareFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 626KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 656KB - Virtual size: 652KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ