b2a30f942a188952d12290f9d0f34a2d1b7cd729ef21d91f0915f34dce18f760 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b2a30f942a188952d12290f9d0f34a2d1b7cd729ef21d91f0915f34dce18f760
Size

6KB
MD5

f306f42e673c8d872848d6b9596d76e2
SHA1

b2fd478d0eb502a392a3ffec1910bdf147b5b6f7
SHA256

b2a30f942a188952d12290f9d0f34a2d1b7cd729ef21d91f0915f34dce18f760
SHA512

58e728183c3b4b24061135432b79311723eb224d467577d9c7bb392fdafae24ca2f4d86ea950425f7b8d292090c12ebd11d42607790ac5a48843ad0406db583d
SSDEEP

48:6SjDxJ6ZWSm5VSQlMgyDgbtZsvHkYbsaqvdpjtoxhjkZ1PBHTaF0czUWMjO:RjtJ6B+wQlpcvH9KjoxaJHGXzUHj

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

b2a30f942a188952d12290f9d0f34a2d1b7cd729ef21d91f0915f34dce18f760
.dll windows x86

567ebca7fdc407d2bf003d80b2a2c20e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateThread
CreateToolhelp32Snapshot
GetCurrentProcessId
OpenProcess
Process32First
Process32Next
Sleep
TerminateThread

user32

SendMessageA

ntdll

ZwSuspendProcess
ZwResumeProcess

Sections

.text
Size: 1024B - Virtual size: 716B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ