a51a47a5db67052e6b10ced0831af103ffd4f26c90f5b4ecc0d643c511e1f6ea | Triage

Sharing

General

Target

a51a47a5db67052e6b10ced0831af103ffd4f26c90f5b4ecc0d643c511e1f6ea
Size

164KB
MD5

e7dc48cab2cd381386061c783b978150
SHA1

72f8a45808c0704ced61776acbab60e1a7cd2b86
SHA256

a51a47a5db67052e6b10ced0831af103ffd4f26c90f5b4ecc0d643c511e1f6ea
SHA512

745dbcc521aea7c147cdea77392aedd7e6030fd3fac8db47c86d41a53740d7da15cff6126b1fb79179fd3d943a800d2e78374b65f5aacf61a20416f1e0950d43
SSDEEP

3072:7jSsupNZOcLb7O9nRRmoRDv/vHDc+Csj9gfUVZKtmyWcDpS9O+iu:7jTuPskb7O9nRRR7I+PefSZ+Dpo

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

a51a47a5db67052e6b10ced0831af103ffd4f26c90f5b4ecc0d643c511e1f6ea
.dll windows x86

2fa91fb1a77eba218037addb693de275

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetCursorPos

gdi32

GetPixel

Sections

.text
Size: - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 322KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 156KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ