b5734cb2194a619ce0c0c2bf5f0b0c9000932b11895d505eea021e2a5739039d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b5734cb2194a619ce0c0c2bf5f0b0c9000932b11895d505eea021e2a5739039d
Size

148KB
MD5

82f9bb0fac1d30db0436975cbf64e11c
SHA1

8a6fd198b7d764fb3c131b7045da6e942ae5d698
SHA256

b5734cb2194a619ce0c0c2bf5f0b0c9000932b11895d505eea021e2a5739039d
SHA512

9fa44520f7848d05d926b27f2df4f790766dd9e35cbac7a517f12ab50ea53af4bd1af785260bc7fcf3ae901c77a21dc631e015be51f929234201f51e0a4ef6b9
SSDEEP

3072:NEDAwqfR6W3oY0kUlAlp1ODjmzw12TdHc6P8+5wmNG+7tPqw:NE1w3OlOI3lG860+HSw

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

b5734cb2194a619ce0c0c2bf5f0b0c9000932b11895d505eea021e2a5739039d
.dll windows x86

50613874316b74dc7f321236cb755963

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

FindWindowA

advapi32

RegCloseKey

Sections

.text
Size: - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ