85389b26c7f1d36d6af7ece820ab8da3380f920d94c27d581b1f2e0b2626e6b0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

85389b26c7f1d36d6af7ece820ab8da3380f920d94c27d581b1f2e0b2626e6b0
Size

256KB
MD5

83e18d98b28e36ada7c90a12e1d04b0b
SHA1

c7bda94bcce255ba92d737a5939b69c0c8fb2a90
SHA256

85389b26c7f1d36d6af7ece820ab8da3380f920d94c27d581b1f2e0b2626e6b0
SHA512

922bfd316fb1fc8187f18128f07cc42a253825dff2c23610862c7d34e2f823ba4601c3591bb692fbc4764d3b80828428d558eeca1ff36f036546d5f8f91cb629
SSDEEP

3072:3BcEeHZbChDn5rKXLe2r0eE/Kh/AcHIFpzKK9CxM9IxMHophEDyLd0uDgxsyMtIp:m7W5u7r07R31KK9v2xML+L9Dga4ue3

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

85389b26c7f1d36d6af7ece820ab8da3380f920d94c27d581b1f2e0b2626e6b0
.exe windows x86

5a5563b04e3472a1c3a459de3dddab42

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord3831

msvcrt

_XcptFilter

kernel32

GetLastError
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetSystemMenu

comdlg32

GetSaveFileNameA

Sections

.text
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 160KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE