446d9e1546cc8bd41576f7720ee0a1c6312d3463d7cc97b137216a75bcb89efe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

446d9e1546cc8bd41576f7720ee0a1c6312d3463d7cc97b137216a75bcb89efe
Size

19KB
MD5

9c3bc49008243b4152e9cc23a28d5070
SHA1

6976e896ac55eb3d896bf17ca9555b3bd962d894
SHA256

446d9e1546cc8bd41576f7720ee0a1c6312d3463d7cc97b137216a75bcb89efe
SHA512

0ae6dfd2ef7688f60e4da85521c5c74f878ed2652109b60b1aca344c6305457bbd0bde42faa1d2ee8f2291f35cc7ec8fc54bb4f6d94309207c1070277287cf17
SSDEEP

384:EafdotcGn2hd8zjQPI8cotr4iLE+5lQfTO/Uli4cGesv6:EIotkhdkUwL1rud6cnsi

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

446d9e1546cc8bd41576f7720ee0a1c6312d3463d7cc97b137216a75bcb89efe
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ