f95ce8dbad92053eb3975dc253fd605b14c0a615c63255066601e177e83eb87c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f95ce8dbad92053eb3975dc253fd605b14c0a615c63255066601e177e83eb87c
Size

71KB
MD5

3a7433e03c4e4458a03832f00f5207ce
SHA1

bf18201c072c3639c2b7fa54030c8524d28abe84
SHA256

f95ce8dbad92053eb3975dc253fd605b14c0a615c63255066601e177e83eb87c
SHA512

3faec69d582fe92d2eca60e64c7551bb8a98c714fec2e8c43203145060c793060f36a7bc4395e3e730e3ef987899f8855d3ff7b3c87843168a231151b1390ee6
SSDEEP

1536:PKCj1do6Se7WRsJhIiWYU0UkSnrWlZvzif2pw/FaOFqh/6Q08Mj4I:PlJd5Se7vJhIASTCUOpyFhSP0/E

Score

8^/10

vmprotect upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

f95ce8dbad92053eb3975dc253fd605b14c0a615c63255066601e177e83eb87c
.exe windows x86

5f7c1c5f782810323dacf24bcb0e83db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
ExitProcess

Sections

UPX0
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE