a8cfdc732a398c2e80f2bb307c29502349b0bb926eb0bcf534b80cc3942b5932 | Triage

Sharing

General

Target

a8cfdc732a398c2e80f2bb307c29502349b0bb926eb0bcf534b80cc3942b5932
Size

296KB
MD5

d086c94109f28de07488e8b4ead00580
SHA1

96ada0002c2e7ddd6637f63a5941f8b0aef31fe2
SHA256

a8cfdc732a398c2e80f2bb307c29502349b0bb926eb0bcf534b80cc3942b5932
SHA512

3d81eac18555704118415596b1ce3bbcc19d3ac0738cf54d76c259774fa3e153b4b66f69e0d2bdf33b6df6170d5a02c826b78ef4413b80f2ff1097ffc2cd4cd4
SSDEEP

6144:Iiz3O30sHoMbWHwsD3PUkQM8A01gLje4IUngCaXdjHg3zCFuzrkjB3Rys:IceksHoMbWHwsDUkQMGgtIogCAE3zCFH

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

a8cfdc732a398c2e80f2bb307c29502349b0bb926eb0bcf534b80cc3942b5932
.dll windows x86

412dab263ead3e3e33d52d5aeeb5bd00

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

ExitWindowsEx

wininet

InternetReadFile

gdi32

CreateFontIndirectA

advapi32

RegOpenKeyA

Sections

.text
Size: - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 434B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ