cd021638ef17e94e3e5b75c2c2a03422eb111bc4dcc6d73ae19d7dca76760389 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cd021638ef17e94e3e5b75c2c2a03422eb111bc4dcc6d73ae19d7dca76760389
Size

212KB
MD5

7e18ae6d464621630b88a4f506bac1d4
SHA1

6088973ac9808bc8c58e2b6a02037df6c2366bc9
SHA256

cd021638ef17e94e3e5b75c2c2a03422eb111bc4dcc6d73ae19d7dca76760389
SHA512

9050d5ca2e14ee955fd1487238d9d6d5548280aeb559b4d83a47ccd9a27e6cb887e0a34821581fd74102185cf38602c4e939894defb19083d6278519bcd5e1e4
SSDEEP

3072:OL0+HfR5/J80ogEHyU7jTIGzh3KLLlCrv7j1hXpXntn/3RnTTjNp5NUY57Yx3H9s:sF/XogjoT1zhD775ntnpnXj9NUTp9s

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

cd021638ef17e94e3e5b75c2c2a03422eb111bc4dcc6d73ae19d7dca76760389
.exe windows x86

ee33975004ac4ddb5d6f9bbb5140ad35

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetMessageA

advapi32

OpenServiceA

msvcrt

_strcmpi

ntdll

ZwUnmapViewOfSection

netapi32

NetApiBufferFree

Sections

.text
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE