e6d11247945e1992f20533c35d286a0848bcc45c4be76686ef8c97b0b660178f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e6d11247945e1992f20533c35d286a0848bcc45c4be76686ef8c97b0b660178f
Size

160KB
MD5

45057efae507a683d7d4de9f111f5970
SHA1

2b091ec069fda62269337a63efd754694f02dca0
SHA256

e6d11247945e1992f20533c35d286a0848bcc45c4be76686ef8c97b0b660178f
SHA512

ff69c7cea2ea9555fd3677e76556b2f03528407585e088222c66f2a93cf1441f0730e5451c9c2f45beeb63f71ef13f1477959c0703e5e4124b7bb3de977487bc
SSDEEP

3072:+S7OwkOvGjlvMEQpBPdPXJnH11DqURNegXhcbYcKmQfQu2x56V8MSLYp:+S7OwkOejVpUVZnV1eicbYpmQ0j4

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

e6d11247945e1992f20533c35d286a0848bcc45c4be76686ef8c97b0b660178f
.dll windows x86

a2544d0140a1e85d3e66c1f3b9dccd6c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsGetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

ScreenToClient

gdi32

GetPixel

Sections

.text
Size: - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 152KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ