e066eaf0ca903cfb392c00eaddf87617ecae38368844a7a283de3e4936a679ee | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e066eaf0ca903cfb392c00eaddf87617ecae38368844a7a283de3e4936a679ee
Size

419KB
MD5

c5292472d256cc1c22d602bf306fc243
SHA1

34956c40189fed919592240375a74a20e22abe10
SHA256

e066eaf0ca903cfb392c00eaddf87617ecae38368844a7a283de3e4936a679ee
SHA512

f70ff94ab6e7ed49a099b8631f0eda723227aec8aab0bdfcc631f5161f3ff32dc2743e2586213c1d2cc3ccf232b9280a06cd75d05a5f7e818ca48e1c91739ab7
SSDEEP

12288:ysyV38N7K0kuSpa+YGNneqrI+mgcHxtybvt5:R+367JkuMa+YGNhM+VcRyt

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

e066eaf0ca903cfb392c00eaddf87617ecae38368844a7a283de3e4936a679ee
.exe windows x86

11cbdfb47fdc9152560598c88ea044f0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

LoadCursorA
MessageBoxA

advapi32

RegEnumKeyExA

ole32

CoTaskMemRealloc

oleaut32

SysStringLen

gdi32

GetStockObject

ntdll

RtlFreeHeap

Sections

.text
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 258KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ