8a2334d984c898c4c62026d1cd5083ef4fbbe294928e708b5aa5227ac4c8fdb6 | Triage

Sharing

General

Target

8a2334d984c898c4c62026d1cd5083ef4fbbe294928e708b5aa5227ac4c8fdb6
Size

195KB
MD5

d94a84e5955315802370b3d2b9429701
SHA1

06973f10717f96b37417eab960fac085a9872730
SHA256

8a2334d984c898c4c62026d1cd5083ef4fbbe294928e708b5aa5227ac4c8fdb6
SHA512

476f9360fbe622b8f0ec07dc8e17db89310e27fc178b158399ee41c541e654c0b1597cf6a8750fba617153b38bc3bf2e459b1d12f2a86bcb82699a2d8046a0aa
SSDEEP

6144:07PsUd2fVCDH0HrK5JTu1nkYpsfjABzIJyNu2O538k:0R2f8b0EJUkqhtu

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

8a2334d984c898c4c62026d1cd5083ef4fbbe294928e708b5aa5227ac4c8fdb6
.exe windows x86

a0aa4ebbbc808256dcc926429ffd067e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

wsprintfA

advapi32

RegSetValueExA

msvcrt

realloc

netapi32

NetUserGetLocalGroups

Sections

.text
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE