6bd630686f0e3437c6d20955cd925bafc139bc749a33ddc3913a8af5323f33aa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6bd630686f0e3437c6d20955cd925bafc139bc749a33ddc3913a8af5323f33aa
Size

96KB
MD5

2314d6f66743f6528973c3491359d957
SHA1

954618545c6bae74ee0dc950c68b194d71582cd6
SHA256

6bd630686f0e3437c6d20955cd925bafc139bc749a33ddc3913a8af5323f33aa
SHA512

e2bf3504b6c96214007e39b715dceec27f802070c7d0d38294d7e4bae53036cabf1375113b004c084205fd6349dbed8e770d1e112e38ca6372a9864b7e348c7a
SSDEEP

1536:nrvrnIeqcASSj7w5GBQhYrlP6doTj/GOJcknStql9L3h2Edc:nrTnIeFAL7MSeiP6do3VStG97h2Ed

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

6bd630686f0e3437c6d20955cd925bafc139bc749a33ddc3913a8af5323f33aa
.exe windows x86

071fc2a12312b1634c41b000dbe58013

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_CItan

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 84KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE