76de676239a6fd9eecc6d9932600b1fb64e00883687438faf104dec3fae537e2 | Triage

Sharing

General

Target

76de676239a6fd9eecc6d9932600b1fb64e00883687438faf104dec3fae537e2
Size

258KB
MD5

4f80e8cbbab9ee0ccdb98c8a3c5f6982
SHA1

c535eddbe39d22f0589f6d0c78d40dda422f5ff8
SHA256

76de676239a6fd9eecc6d9932600b1fb64e00883687438faf104dec3fae537e2
SHA512

59787de6d3daaf4a557e1c90a9ef1de23a157a9936092c334750a093b47bba4be4b10e38dc8bacc91f75e4d0791993812d947d37e4eb4ee7ca58c51fec5f6938
SSDEEP

6144:WaNnu9F7LzW12dbEpV0Fpir/20e8XM25StBFAV0qDWD7N:lZufLzlXpirDe8c25qBFK0qg7

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

76de676239a6fd9eecc6d9932600b1fb64e00883687438faf104dec3fae537e2
.exe windows x86

28982852ed721fa718b8378261fc650c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

LoadCursorA
MessageBoxA

advapi32

RegOpenKeyExA

msvcrt

_except_handler3

netapi32

NetApiBufferFree

Sections

.text
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ