b299f224b898f3882638d02879e9da1de1ab31480159771001b7514233151731 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b299f224b898f3882638d02879e9da1de1ab31480159771001b7514233151731
Size

525KB
MD5

2ed2df37c54d2d05207f585a53fcb770
SHA1

16c92f89a93dd216c96d11bb8f1dc72a9191ca17
SHA256

b299f224b898f3882638d02879e9da1de1ab31480159771001b7514233151731
SHA512

25491cce661f034759238c7d40d65ffebb6f3076740e37719f954ad1647c747baff08aebf27b97d5f41af6fb8ad53454738bacfb5c217e341fe7fb8b6107d192
SSDEEP

6144:tErL6xPFB/ZIvc5i2TFf9pbRSWUXp/KNW0EP+R44SiBclE4CEqpoQWMdBITi6RRm:KLtv6iwnCXpAFEV4ElbQ1MNRgwR/dwT

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

b299f224b898f3882638d02879e9da1de1ab31480159771001b7514233151731
.exe windows x86

b0994211a282e0a5ea44aa2eaee7dc80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RaiseException
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

ole32

OleInitialize

oleaut32

SafeArrayCreate

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ