110f6f3a2e113e50509a9d231f194ebce40179585d875947b9f89ef799919f73 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

110f6f3a2e113e50509a9d231f194ebce40179585d875947b9f89ef799919f73
Size

684KB
MD5

bb078a7e3846925ef157124782ddb2a2
SHA1

17a72aaa666ed3ca2f9197859060ac47c1060a87
SHA256

110f6f3a2e113e50509a9d231f194ebce40179585d875947b9f89ef799919f73
SHA512

dbb5869f08eeae97f91ee4b2353ee9b8927171f1e4a56b3e302c7827416a5a9b5f2740438459f21cc32ec63d4e6eb7f3243e88a302d4f6ef0d7ace072f222173
SSDEEP

12288:X/xHr7iyYopFv8BbLYfVSg7CDnDOzgGTDqrYaSmfxS4yDUujDKo:JPiypFUBb8fVZ7mnmgGTKdSaxhyz

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

110f6f3a2e113e50509a9d231f194ebce40179585d875947b9f89ef799919f73
.exe windows x86

15fd8f776d8aa6e33b64818449731954

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
MessageBoxA

kernel32

CloseHandle
GetModuleHandleA
GetProcAddress
VirtualProtect

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 750B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 664KB - Virtual size: 661KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ