f814623e7907bf620a8d686aaa73e9de17273d0b0bed8557df4f862d0fa41ca4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f814623e7907bf620a8d686aaa73e9de17273d0b0bed8557df4f862d0fa41ca4
Size

201KB
MD5

68e43e758259b281a3ee8462f454099f
SHA1

e6be38ebf1798fabc53c9065b0d4cfda80e7c94d
SHA256

f814623e7907bf620a8d686aaa73e9de17273d0b0bed8557df4f862d0fa41ca4
SHA512

fd3da619b5795b5f30a356a3ff90ee916ef44147ef06e14b793505ea7c2e7171fcca9238a1ca7e60deae90a7ccd97ce2bddd476714a685a6fb31bda8e8a9c8aa
SSDEEP

6144:2K7nj1rLixcgaA0311vnrwmYKhVVj7Jbl4SKsW:3JLFgn03PrwlSVb0s

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

f814623e7907bf620a8d686aaa73e9de17273d0b0bed8557df4f862d0fa41ca4
.exe windows x86

3fbad927aeb9f1ec50f749eaed9685f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtCreateFile

kernel32

TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ