ee6037c18ae60a2ef347d99a9b77e6873c13c015a4932756f02a9dd5f27456bd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ee6037c18ae60a2ef347d99a9b77e6873c13c015a4932756f02a9dd5f27456bd
Size

87KB
MD5

43112945ef084465e106e44168cafe48
SHA1

836e21be11f6fb205a20555e5dc1aa725b044246
SHA256

ee6037c18ae60a2ef347d99a9b77e6873c13c015a4932756f02a9dd5f27456bd
SHA512

fff76de182c4c5e490cb8db82ec51c3e463f00594873a8c812da960af1f3ac950a02720cf0c1ad05ba5300c1c12eff2c7a99b259e1f0810ae37707f06e966891
SSDEEP

1536:JtGyiV7MIui66K1EypYru9S+EANDyFrtVkkDNRSZ6r+fF3o:JtsV7MIuizK1/erK5pu/XNI64F3o

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

ee6037c18ae60a2ef347d99a9b77e6873c13c015a4932756f02a9dd5f27456bd
.exe windows x86

cc6e7edca18b9fe361a910f0e29d0849

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ