8659c7485d49b8fcdcaa84848926ccb800e15797d4666de1e2cd5eb5bea92844 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8659c7485d49b8fcdcaa84848926ccb800e15797d4666de1e2cd5eb5bea92844
Size

1.4MB
MD5

17ada576f40ccbb594012e5d0b037b31
SHA1

b44b94427c73e36bc9a8472c689ca8f648094f0b
SHA256

8659c7485d49b8fcdcaa84848926ccb800e15797d4666de1e2cd5eb5bea92844
SHA512

b7173f238e0a12c75c5df6ab2788c872c2f0ef544611e998b303e96bbdd1602644f90cabcc8d0ce4d29d8578dc5d00c999e6ae46202a518599163eabec37ee6f
SSDEEP

24576:pA2ft3C3u9cYcWH7ssU2D1dy/YfYv7zjx96FT3oaVcWx5KvS2AncfHwVxOyqy0Wn:pA2IO6WrBD1wQfYPjx984abYK2AcGAWn

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

8659c7485d49b8fcdcaa84848926ccb800e15797d4666de1e2cd5eb5bea92844
.exe windows x86

999f0ae4ca3dbead6359b6974f056340

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord546

user32

MessageBoxA

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE