7194cd747c7aebd308cb5ce6c0a2e3de207473d310a937501d5c3a2e1b539939 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7194cd747c7aebd308cb5ce6c0a2e3de207473d310a937501d5c3a2e1b539939
Size

880KB
MD5

c9b560ee155075b64f181c6145768cb3
SHA1

bcd145b66aff0c19dfc4a6821b3c0a3e413b69c2
SHA256

7194cd747c7aebd308cb5ce6c0a2e3de207473d310a937501d5c3a2e1b539939
SHA512

f5bee6408e11920c159ba14ad222254e98da45ed14c90b8a7855009570f12e0aa53c2307ad6b489c709b15e2326639078ef08a2d02e4376100f989921b56c847
SSDEEP

24576:1i8wsBXMSd917aHZGzILaa/t5bgVc2iyMg81v:1usRR7a5GzI//tic2izP

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

7194cd747c7aebd308cb5ce6c0a2e3de207473d310a937501d5c3a2e1b539939
.exe windows x86

50d99d8d2486cc9718aa23fa74694c1b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord6375

msvcrt

__set_app_type

kernel32

LockResource
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess

user32

SendMessageA

advapi32

OpenProcessToken

shell32

ShellExecuteA

Sections

.text
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 466KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 868KB - Virtual size: 865KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE