bab3b2fd3fd92fef408494356aaf3e970e2c613a8bc78e680c37a66588d4caf2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bab3b2fd3fd92fef408494356aaf3e970e2c613a8bc78e680c37a66588d4caf2
Size

167KB
MD5

2067d86bbda5a92acb5be1c4b373e19f
SHA1

1148e2d6f11dac0a273c5762c59d283b9519aace
SHA256

bab3b2fd3fd92fef408494356aaf3e970e2c613a8bc78e680c37a66588d4caf2
SHA512

01c3e9267c5d1b3e2220fe3107b7062cfe7e6c23254c6908b8efea897b9886db7c6958c858108db6371fb245a3ef516d0f574978c4e1a21e5aae28b5bf16b84a
SSDEEP

3072:G+BC3K5eqUyRngoAYdKl3O6HfhmvEUbaArG85RkeEgh22b413Z:mK7UtoTYl3/psEU/rG85RkeRH41J

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

bab3b2fd3fd92fef408494356aaf3e970e2c613a8bc78e680c37a66588d4caf2
.exe windows x86

3fbad927aeb9f1ec50f749eaed9685f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtCreateFile

kernel32

TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ