b46e798af5e8d60d1a094d9684aafbb7245ad6f8ab7b1fefa13b115aa6356b77 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b46e798af5e8d60d1a094d9684aafbb7245ad6f8ab7b1fefa13b115aa6356b77
Size

84KB
MD5

363ce7324823ae54dda99803588d7e39
SHA1

81ed9bf745dbbf6a1282d5bea11d1e81189cd23a
SHA256

b46e798af5e8d60d1a094d9684aafbb7245ad6f8ab7b1fefa13b115aa6356b77
SHA512

bb92440ec518b4150cd3be39fc82dd7f9611123d2e45b2e0ffa7e05d59a5e62665b344cd445200aa8c08cfe44891a9bfa21ff9a2106cfff6762a385f2d39cb17
SSDEEP

1536:lVa0qF1RmiGe0YgYV8a3wTClWvgT+bEo4xUWLItv/5aAYDF7va:Qnce0PeSCVT+bEo4d6vxCFG

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

b46e798af5e8d60d1a094d9684aafbb7245ad6f8ab7b1fefa13b115aa6356b77
.dll windows x86

a594a232ec97f3a1485e11d1ff89e304

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetModuleHandleA
GetProcAddress
VirtualProtect

Exports

Exports

exp_GetHardwareInfo

Sections

.text
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ