ff40a62ad0d824185174d91f55ad6af6689a79568eedfd74de334cb81bae23c1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ff40a62ad0d824185174d91f55ad6af6689a79568eedfd74de334cb81bae23c1
Size

126KB
MD5

293ffaad5ae50368bae61fcdbb9cf9a8
SHA1

0b9a5285648207c5271f8506b93ab5952bfefeba
SHA256

ff40a62ad0d824185174d91f55ad6af6689a79568eedfd74de334cb81bae23c1
SHA512

8f931feb6772966698b85c65b7dd4a0588b8dff4dc94d94d971a4a1376f717c241728c653333bbdfa09aa77c26ab3b91636d66cc3e6fd8cd9df8b2a513dfbaf3
SSDEEP

3072:xmix0Zkw84TTdkYvMjfi77vUL1FI7ZizwMA1sqku6er:iZg4TmYvMjfr12iz9e

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

ff40a62ad0d824185174d91f55ad6af6689a79568eedfd74de334cb81bae23c1
.exe windows x86

13610ed0300ad691beaa2e1045905372

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFileTimeToFileTime
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

wsprintfA
MessageBoxA

advapi32

OpenSCManagerA

shlwapi

StrStrIA

msvcrt

_controlfp

Sections

.text
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ