cb413c069984722f75e5a9b20578e7a740d1660eb2fb44fc04caf5651d575c01 | Triage

Sharing

General

Target

cb413c069984722f75e5a9b20578e7a740d1660eb2fb44fc04caf5651d575c01
Size

193KB
MD5

ef4b7314c387e1160af63c798c4b37d6
SHA1

e0e406ecd7dd3a9e0b7743481bb8dfef17e402d4
SHA256

cb413c069984722f75e5a9b20578e7a740d1660eb2fb44fc04caf5651d575c01
SHA512

7833c0e761576c7d9369fd22259d6329f874ed56af42d2fad9cd28c421f6380c47bc4168de64ad494a398036c093b9f91fe3a398d02491a381c54f1fd52b4355
SSDEEP

3072:V+BC3K5eqaK9ps9p/L12OXDQZxiLDuAX8v4qDiQRHIehAdkCwlIrhBFgp7pPmsKp:3K7afptUiHuAsQqhoGAd1wiwteSul

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

cb413c069984722f75e5a9b20578e7a740d1660eb2fb44fc04caf5651d575c01
.exe windows x86

3fbad927aeb9f1ec50f749eaed9685f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtCreateFile

kernel32

TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ