cafdba86e2d218b4a0dcf14ec5b7315e52318124de5b90c48a1eb300019aead1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cafdba86e2d218b4a0dcf14ec5b7315e52318124de5b90c48a1eb300019aead1
Size

385KB
MD5

cf0ddaf89a92156ef16f62bd6e364351
SHA1

d072573dbdfc21c5aae1cb7f1f418fd22b5ad90e
SHA256

cafdba86e2d218b4a0dcf14ec5b7315e52318124de5b90c48a1eb300019aead1
SHA512

f59a5f6cccf80eb541f0123d8f9fccfb4cf78f58d6852c7bba7b9892debd05e75a332975d5e37f4fc891f6e36bdec5518a6426d9535b6306c249c1b9f5351d1e
SSDEEP

6144:pnYzfCyzX1BWcH8cbzU/6h0/7NqJPVtl6Pd:FYbCyzFBqMq6hERsblCd

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

cafdba86e2d218b4a0dcf14ec5b7315e52318124de5b90c48a1eb300019aead1
.exe windows x86

11cbdfb47fdc9152560598c88ea044f0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

LoadCursorA
MessageBoxA

advapi32

RegEnumKeyExA

ole32

CoTaskMemRealloc

oleaut32

SysStringLen

gdi32

GetStockObject

ntdll

RtlFreeHeap

Sections

.text
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ