f778446717381bd67b43e803ef7a950dc0ca15523ae30af7a68613e25930e3f0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f778446717381bd67b43e803ef7a950dc0ca15523ae30af7a68613e25930e3f0
Size

176KB
MD5

b8d4336f6dbef7cc91d8cf1a25a66991
SHA1

47548c30e1fdaf7ed1e4b5a8eb243b24bd7cef5a
SHA256

f778446717381bd67b43e803ef7a950dc0ca15523ae30af7a68613e25930e3f0
SHA512

8ef935ffb74abf100163769636b86692a8e04320d6a8e33cde5748d3c0f6e14af3da920d8d227e6e37aaa464c30a757720f1576dbd8e59d369870159940305bb
SSDEEP

3072:l+BC3K5eqW7d2UWhXyQsrTs1m3LgUTC5tUn/N6pmaAwmMj7c8gNlEBjAgMJUmoRU:HK7WmcgE3jISn/NwfAwzj7crDWjATJuU

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

f778446717381bd67b43e803ef7a950dc0ca15523ae30af7a68613e25930e3f0
.exe windows x86

3fbad927aeb9f1ec50f749eaed9685f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtCreateFile

kernel32

TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ