ffc56d601420b42bedf74a64e38a9e76dc5b1baee4eea837ee8b1604d63976ee | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ffc56d601420b42bedf74a64e38a9e76dc5b1baee4eea837ee8b1604d63976ee
Size

190KB
MD5

a8e4a8f6f9e5025190f6a7d698666bbf
SHA1

465f6881ab30680ec167882c69fb796670a57f6c
SHA256

ffc56d601420b42bedf74a64e38a9e76dc5b1baee4eea837ee8b1604d63976ee
SHA512

f0840a89e96b1b7e21ecfea6ece1e6c656c6b3c6cc612ee4f0b9c441f0cd0c61f49bb82917f6ab89689c30528cfed530fe8a240bbaf78cae4f6b212f0afcacf8
SSDEEP

3072:O+BC3K5eqzSNJgC7Eyj6Mp44ZAb3Wu7W0hFC5eYQJCop8/h8eUnZ3QAZKz6:eK7EJg9yjFYWMlh1tpwh5yZ3Qzz6

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

ffc56d601420b42bedf74a64e38a9e76dc5b1baee4eea837ee8b1604d63976ee
.exe windows x86

3fbad927aeb9f1ec50f749eaed9685f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtCreateFile

kernel32

TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ