06d487e066926c7cabd072ab64d4f4519d7c3b9e0937eae52dae510fa4c5dc21 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06d487e066926c7cabd072ab64d4f4519d7c3b9e0937eae52dae510fa4c5dc21
Size

73KB
MD5

8fe064aae19923c5f709d2542ab9f3d0
SHA1

d3a12354fc2e5431f75a94e7a80d3ca45ae3af5f
SHA256

06d487e066926c7cabd072ab64d4f4519d7c3b9e0937eae52dae510fa4c5dc21
SHA512

01948ea6225732507ddd59e4c81d8f847709001061c1f29680c1c6420017c5cfba9779104dc0d63751f225d299751bb48df95799a594e04b4a5211be0cd97116
SSDEEP

1536:wB05+ShlaAOcdKen/wFnToIfHTR5r5JZNTeiFp0zA+V/R8:G05+Sien/wtTBfHTR5r5JZNTeiP0Z

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

06d487e066926c7cabd072ab64d4f4519d7c3b9e0937eae52dae510fa4c5dc21
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

Install
RundllInstall
RundllUninstall
ServiceMain

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ