7a0b3b978c7cf3200f9b3d7bd186dff2d59a6252065ab267e608654bfeead53c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7a0b3b978c7cf3200f9b3d7bd186dff2d59a6252065ab267e608654bfeead53c
Size

160KB
MD5

b5038860498f24580e6e481e4851cdd9
SHA1

61757c52d635a444811b91924453d13b48e17a6a
SHA256

7a0b3b978c7cf3200f9b3d7bd186dff2d59a6252065ab267e608654bfeead53c
SHA512

1eff67f61da20771cdf6006a0bf9c185a82268428237c50686807c7380c572c8868ebf0e97795b69f56895a319745224707e438330e9299c7475dd70fb759a31
SSDEEP

3072:kwBzN+VPh0O6Duyr3poPnRu3Ij8/Ctsp08QTqp4C0r7xU:kw6th0O7e5oPAE8/Ctc9aqph0r

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

7a0b3b978c7cf3200f9b3d7bd186dff2d59a6252065ab267e608654bfeead53c
.dll windows x86

3f12f956599f9e4440a37ae4e5452895

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

FindWindowA

advapi32

RegOpenKeyA

Sections

.text
Size: - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ