a832896a11a17abf0fb8d55a0d999c6f755244587dba2d6a22080cb527ad73c9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a832896a11a17abf0fb8d55a0d999c6f755244587dba2d6a22080cb527ad73c9
Size

116KB
MD5

bbfa3e9b9076ca6a3685adddc2d9bd4d
SHA1

44ff853fa1c54bc3f402f72a33680d808088768b
SHA256

a832896a11a17abf0fb8d55a0d999c6f755244587dba2d6a22080cb527ad73c9
SHA512

14f883068eb39a8791434c95dfd212ae85e14130de8357c433772824a167176885c943b41710b1c42904e1f58dd739f0b56d824e222fe2fcb19b33d8b3d1116f
SSDEEP

3072:mLtg/odbE+i36RDBDQ1/4VFB26zVAAzvkJNKE:1odE+iG0w3BjknK

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

a832896a11a17abf0fb8d55a0d999c6f755244587dba2d6a22080cb527ad73c9
.dll windows x86

20829b103668cd8723869a3e6afa99d7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

ShowWindow

Sections

.text
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.vmp2
Size: 108KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ