bdd9c21c43049f6f4b59323c5e8fc704ee950bd10a4187b3e178189dfc9284c4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bdd9c21c43049f6f4b59323c5e8fc704ee950bd10a4187b3e178189dfc9284c4
Size

163KB
MD5

556317c66549955fdc36639acffc50ce
SHA1

37c1de591179286aca01bd6323e43c4f674bc84b
SHA256

bdd9c21c43049f6f4b59323c5e8fc704ee950bd10a4187b3e178189dfc9284c4
SHA512

700d6ad9dc264aa19680db79d8701738631761594170dfe14ad9c8c0d4808d5c275d210068fe7bb14f1a2eb1d20527977f6a9378ba9449d02d6dcb1119e7f520
SSDEEP

3072:X+BC3K5eq5pVPXmx8L/AWGwR1vGHIAdEZflQNPZzsLwXxy6jzEF:pK7DpWUAWGSvI5d6fa3A2zEF

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

bdd9c21c43049f6f4b59323c5e8fc704ee950bd10a4187b3e178189dfc9284c4
.exe windows x86

3fbad927aeb9f1ec50f749eaed9685f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtCreateFile

kernel32

TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ