ea9734df822a3744c41b64c0ee14d35f273d6b6fdca6e1fc7aa4bd74a67ac424 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ea9734df822a3744c41b64c0ee14d35f273d6b6fdca6e1fc7aa4bd74a67ac424
Size

808KB
MD5

1998d758a315720c63ebc5b90bc73f00
SHA1

bed713d021dd7bc77293e38bf47d2c724597c8c3
SHA256

ea9734df822a3744c41b64c0ee14d35f273d6b6fdca6e1fc7aa4bd74a67ac424
SHA512

f0dd4a919d4212ddc4a6c0724a4e904ee14cd8074f265b939165d6873997ad9c27e1fc1a845f9fe68a3b0b00cc232cfc7bd406d329382ccec1dfa7b3e36ce6ac
SSDEEP

24576:zJSU3leP1Afz8XEkH6cdbYfF+L3UY4VpQxm0:lh4Qz8XEkNdbYfwL3CpAm

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

ea9734df822a3744c41b64c0ee14d35f273d6b6fdca6e1fc7aa4bd74a67ac424
.exe windows x86

f5fe4bbe71e41d6ab7b2f04618ddab12

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarCmpNe

kernel32

GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 726KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 796KB - Virtual size: 792KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ