db1588de303785ba9307a83995ee7561d383135397b8a94e19070ac122f18a07 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

db1588de303785ba9307a83995ee7561d383135397b8a94e19070ac122f18a07
Size

80KB
MD5

aee367ee32a2d9ebba6d90177f775980
SHA1

d586234b532be0153f4c76ff7f4149233fdda5fe
SHA256

db1588de303785ba9307a83995ee7561d383135397b8a94e19070ac122f18a07
SHA512

14b1eb766b4e089a474ef8e46e3adf903d0f1c75a5b6e0158b2dd6b1bdff85e404ba205083b4f008f67b433081367a45a8b8a4ec75c6fcf7cd30a9a339a3f031
SSDEEP

1536:T+0b+lzlaACcIpen/VPnToIfHTRzr5JxNTeiFp0zA+V/R8fn7a9:S0b+l+en/VfTBfHTRzr5JxNTeiP0ZUO9

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

db1588de303785ba9307a83995ee7561d383135397b8a94e19070ac122f18a07
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

Install
RundllInstall
RundllUninstall
ServiceMain

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ