52ea55d087ca56bb80aa24c489eb452df3b23c3f2343a93cc62f6e48a1c97426 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

52ea55d087ca56bb80aa24c489eb452df3b23c3f2343a93cc62f6e48a1c97426
Size

800KB
MD5

09b0c1706063108baabf8290469e1431
SHA1

a18ec3e5d53326a1affbfb9f02624030373a36ae
SHA256

52ea55d087ca56bb80aa24c489eb452df3b23c3f2343a93cc62f6e48a1c97426
SHA512

c271da968b7621f038a3f021bddf841344d57b964c4b7572a9111b320438e6e199cc144f173c3bd82e07514507b00fa69fff728fcfaad6732c6666e882afd668
SSDEEP

24576:tq/jm9ky+FY+tanNZB7qK+qkPo7gQuo2aRRY7zh5:tq/iiy+FgNZBqPEgvDeS7z

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

52ea55d087ca56bb80aa24c489eb452df3b23c3f2343a93cc62f6e48a1c97426
.exe windows x86

4518cc2a28a35d2f7bf54c763df6cdcb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW
MessageBoxA

Sections

.text
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 723KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 796KB - Virtual size: 792KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE