46bc8eb0bbd54b8c7c4999398c3e7ab79e0a327c0e03efeb797ffd0466c7dcc3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

46bc8eb0bbd54b8c7c4999398c3e7ab79e0a327c0e03efeb797ffd0466c7dcc3
Size

780KB
MD5

9a4bb14c8464c100b8ea0618370e3a29
SHA1

51185d98327740cccacd33252c0d29d45b6bfe18
SHA256

46bc8eb0bbd54b8c7c4999398c3e7ab79e0a327c0e03efeb797ffd0466c7dcc3
SHA512

7f1bfcd90f7e027075a731775fc494cd0776b0ffb3782f96172336c82c976fa0d63eca55876d90f09e8d7260aff14a18baa50f6c8b93f68e6628aa02d95eedee
SSDEEP

12288:MHYo5KmEamsjkxhMLeKdlz9KKkQNp6Inu4D2OXEIRinXmJCO2fqh1VoTpgsjg2:MHYgKwjk2zm+p6vu5XeX0hMgl2

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

46bc8eb0bbd54b8c7c4999398c3e7ab79e0a327c0e03efeb797ffd0466c7dcc3
.exe windows x86

4c239afc1b8ec27cf2ec0a3877205057

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaLateIdCall

kernel32

HeapSize
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 712KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 768KB - Virtual size: 767KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ