ec1eff842eb47fbd3ec1abb22d327be5d1d0adcb210f5bba9e74a6911b9c930c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ec1eff842eb47fbd3ec1abb22d327be5d1d0adcb210f5bba9e74a6911b9c930c
Size

270KB
MD5

1acd0880a8643e80f33b4795dffe5056
SHA1

3b3d600f1b6ca9009971e02acad40d9116819f74
SHA256

ec1eff842eb47fbd3ec1abb22d327be5d1d0adcb210f5bba9e74a6911b9c930c
SHA512

bfb117a0a073be9bec127b0bdbe04ba0265a1b4139955dbda3501a1fdab0cee6afcd42ccccfa8bf84c6282fc33d8d228a13c8510a164f7331e6e59399b8a1912
SSDEEP

6144:tMdsFlLm+pMMGo3hW5/A5PyFmtbqJKQcSr78wxW2TKjEpwlr1oh:iipTGo3QKwKwQwxP+jEpwlOh

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

ec1eff842eb47fbd3ec1abb22d327be5d1d0adcb210f5bba9e74a6911b9c930c
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ