e8fb3633084bd6a1a016267f8ad6ecdcb0cb7186f369672f6ca15d567565b9a5 | Triage

Sharing

General

Target

e8fb3633084bd6a1a016267f8ad6ecdcb0cb7186f369672f6ca15d567565b9a5
Size

292KB
MD5

044a4a04b4d8dd5a0e701889e051059f
SHA1

c3bd3b96d233f8469f527b4fa6938c0c2a4c22a7
SHA256

e8fb3633084bd6a1a016267f8ad6ecdcb0cb7186f369672f6ca15d567565b9a5
SHA512

c88656d0a39a38c75e61a5bcc84dee0b53a5e29e991933448a412ff0ea52dee00c2bb42469400772bc269eb134a3ca0acb2ed867cd70bd328652986011c7f634
SSDEEP

6144:aJGGO/h3CccOufY01I5QiOsUsJHgstJbcSh/+SrmIL4J2mH:aJrO/NCccOf13ystu4/DrmxE+

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

e8fb3633084bd6a1a016267f8ad6ecdcb0cb7186f369672f6ca15d567565b9a5
.exe windows x86

d387da7f9adeadd84322466ce588edbd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

FindWindowA
MessageBoxA

advapi32

RegEnumKeyExA

shell32

ShellExecuteA

msvcrt

_XcptFilter

wininet

FindNextUrlCacheEntryA

Sections

.text
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 488KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 286KB - Virtual size: 286KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ