f114b037a99e466552c3b4b704d018e6895d4a0835e794ee2c30e782416ee1fe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f114b037a99e466552c3b4b704d018e6895d4a0835e794ee2c30e782416ee1fe
Size

164KB
MD5

fbc325f8f7d6ea522190d2fe87162461
SHA1

8bf891e5a2b44d69cb8f430a1502641ca0696984
SHA256

f114b037a99e466552c3b4b704d018e6895d4a0835e794ee2c30e782416ee1fe
SHA512

0ac01e9b924b1c4d55ecb724baeb625dc5daabbcfa0e7ebdeac2229dcac30584ff5ab0e83e70fcb86cccfcbf5cfe3ca9c3310925f1e6aef1edc18367919ade9c
SSDEEP

3072:W2+BC3K5eqNoqe3+tTz5hTX0u+806GPFeAdohepgSBIMYRjm+lZhuiMLZ:RK7NFeutTlhTX0uF06GPFtkOg2gjm+Pw

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

f114b037a99e466552c3b4b704d018e6895d4a0835e794ee2c30e782416ee1fe
.exe windows x86

3fbad927aeb9f1ec50f749eaed9685f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtCreateFile

kernel32

TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ