a32e8e7bbb54c1724aa9ed8fc8287c3554c57765f32afb489c42c8e070d93bfb | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a32e8e7bbb54c1724aa9ed8fc8287c3554c57765f32afb489c42c8e070d93bfb
Size

156KB
MD5

30bde79b44a7d6802ad0b3456e56d20d
SHA1

8e7c30c2abc5a8b76761227d6814a1d214922302
SHA256

a32e8e7bbb54c1724aa9ed8fc8287c3554c57765f32afb489c42c8e070d93bfb
SHA512

9d98b71ebba29221aff76a67a43de69649cd0e3423e1b457827b29e3439f4dcc39e1a3eca2d50a71632b7a20f06969ad6ad585f3a4d4c199a654f10cd309d1b2
SSDEEP

3072:Ww2tWTRn4UvY7Gyhawniopg44L3ZLmcnZNzqVw4n:Ww2oR4UvAG2aqioaPL3ZLmcnXJ

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

a32e8e7bbb54c1724aa9ed8fc8287c3554c57765f32afb489c42c8e070d93bfb
.dll windows x86

bc999cab69b43630b013a558b3adc2b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetWindowRect

advapi32

RegOpenKeyA

Sections

.text
Size: - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 148KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ