9b6841cb99f778d8d49381c5ee1850f064a6d0ea7dda4d1539624a924bc54ba1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9b6841cb99f778d8d49381c5ee1850f064a6d0ea7dda4d1539624a924bc54ba1
Size

160KB
MD5

046de7dc0bc4aabd483bf09dd7ad0ca2
SHA1

e0e4a37404d27ba93734df9e38039c9541fca477
SHA256

9b6841cb99f778d8d49381c5ee1850f064a6d0ea7dda4d1539624a924bc54ba1
SHA512

4c3fc349781f0a30f567dc65ed74581bf04a8aea12cd0db79a4fb438b7ad471dafa26d10d69d7bd2ed15863d04bb60dcf4742d501cedc73f247c7ecde18f664f
SSDEEP

3072:GttPE1amXVE/3Yo1pWVLmcJOcuk89mFWwAJFSFtQInKVqQx:Gtea46311pYJUk2yWfJgENz

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

9b6841cb99f778d8d49381c5ee1850f064a6d0ea7dda4d1539624a924bc54ba1
.dll windows x86

044deee35dfbdd8d41172d16b88cf823

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetCursorPos

advapi32

RegOpenKeyA

Sections

.text
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 152KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ