eaa32081425d510178e34c65235147ec9192c05b41bbd4078a9c2ce28484f44b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eaa32081425d510178e34c65235147ec9192c05b41bbd4078a9c2ce28484f44b
Size

3.5MB
MD5

c5fe50ae4ed54389e42df97ab08d8db1
SHA1

959ff8610db4495265d8142ee34dc67d70e4e42f
SHA256

eaa32081425d510178e34c65235147ec9192c05b41bbd4078a9c2ce28484f44b
SHA512

796455cbe815d50567182b1343528f6d0fef2939f91ec9daa98fd3eb271ab63f1ea173d29244451d82de04593eecde1658bb9bd31345fab1189e9664946ee41e
SSDEEP

98304:LdgKCUql/uN85gu/zepEyrGBr4Np3WC5e:hgKCtxM85RrkEf4p3WC5e

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

eaa32081425d510178e34c65235147ec9192c05b41bbd4078a9c2ce28484f44b
.exe windows x64

5222e722e78d4a06ff55b37fdde0c333

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ReadFile
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

winhttp

WinHttpCloseHandle

user32

GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 916KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ