af4c34a814baeb2a89b268f843065d9788a7aa90350d8af1b06851bf2c4a3cc2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af4c34a814baeb2a89b268f843065d9788a7aa90350d8af1b06851bf2c4a3cc2
Size

3.5MB
MD5

f60b11eb3739a57b4d73863c2a59e084
SHA1

b9c332322091a5b681c5f17364d8a3c1544e4c73
SHA256

af4c34a814baeb2a89b268f843065d9788a7aa90350d8af1b06851bf2c4a3cc2
SHA512

1e5f4c8799a12c5e186bfb51469689297399c15e8b3d820943ae6e15b08caf75397f1392137929397822e969608d5520bc488f9dba0b1a9cc6e8a55bf66dea31
SSDEEP

49152:jNOwVHvP2gvIDtekSFeLcpO3OyBnuV7qMSS/zKRBJwnygPHarB4T3cr7P34tyWId:JX2gzEcXyBuV7F/czw5TcCyHj

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

af4c34a814baeb2a89b268f843065d9788a7aa90350d8af1b06851bf2c4a3cc2
.exe windows x64

5222e722e78d4a06ff55b37fdde0c333

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ReadFile
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

winhttp

WinHttpCloseHandle

user32

GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 916KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ