cd9beb740111ac288c3f9cd4e4150e9a2c2400f6d6cad8967fcd53ee55414967 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cd9beb740111ac288c3f9cd4e4150e9a2c2400f6d6cad8967fcd53ee55414967
Size

974KB
MD5

6a95d3307a73e106a9f61e2f710f7621
SHA1

38bbbc2d68e6ddf424e96e4159a3e853e9a902b9
SHA256

cd9beb740111ac288c3f9cd4e4150e9a2c2400f6d6cad8967fcd53ee55414967
SHA512

7e8cebccbe3136a840c2454d7a13c7721ffc9a9fa58883b76aaddfb01c25aca265ac5524dab5b84fe6e6665c6573dfc6d4109946fc34beb70a029655ecb46926
SSDEEP

24576:5apo3dxRVoZ1LMoCFFLRtoLygNxGhpblFzfqscWei:5apo3dDVoZ1goCFVRtoLy/rbF5ei

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

cd9beb740111ac288c3f9cd4e4150e9a2c2400f6d6cad8967fcd53ee55414967
.exe windows x86

11cbdfb47fdc9152560598c88ea044f0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

LoadCursorA
MessageBoxA

advapi32

RegEnumKeyExA

ole32

CoTaskMemRealloc

oleaut32

SysStringLen

gdi32

GetStockObject

ntdll

RtlFreeHeap

Sections

.text
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 1018KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 805KB - Virtual size: 804KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ