feb1a66ea77a6fdc4b1c690df5d2a851687768afffc060198aa77754e811aae9 | Triage

Sharing

General

Target

feb1a66ea77a6fdc4b1c690df5d2a851687768afffc060198aa77754e811aae9
Size

408KB
MD5

08252eaf125435946783fcbc9874a064
SHA1

e47fe7b0c4dcaf172cfb785ae17f7963046a891d
SHA256

feb1a66ea77a6fdc4b1c690df5d2a851687768afffc060198aa77754e811aae9
SHA512

a8329da82ec7e418f4aa108ae11d0d584a8884dd9e6f9ff6c97977000d5e437884b85782dff30fc871c3c4e4ffed64ffac5b4511f5c228df49d3feaf62c3a9c9
SSDEEP

6144:qTzncPRf7XWpbpKSmJ2qL6WsVOKcQwm3LBlKC:gA5Mdhmo6H2cC

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

feb1a66ea77a6fdc4b1c690df5d2a851687768afffc060198aa77754e811aae9
.exe windows x86

11cbdfb47fdc9152560598c88ea044f0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

LoadCursorA
MessageBoxA

advapi32

RegEnumKeyExA

ole32

CoTaskMemRealloc

oleaut32

SysStringLen

gdi32

GetStockObject

ntdll

RtlFreeHeap

Sections

.text
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 238KB - Virtual size: 238KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ