b762956948eaeac8a187f01da47b1d89c0c5bb7295847b183a32ad7c083973b8 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b762956948eaeac8a187f01da47b1d89c0c5bb7295847b183a32ad7c083973b8
Size

167KB
MD5

999bf6243cbb08c56fc30364716a0331
SHA1

cb1427f50290ec28fb9b8837e62293ce77ea0d6a
SHA256

b762956948eaeac8a187f01da47b1d89c0c5bb7295847b183a32ad7c083973b8
SHA512

c32a9ee4ca99c569e0ee8b5d1066c45a8dad71839f655366a5017f58dcdbe9f0949bd8f2c5d4bf31b870a081e4613e134b8eef875b1ab6e688a4fdcf52b90910
SSDEEP

3072:y+BC3K5eqj1/Bi0ECPjTfQGPAWlSrRMbcXBZYG6hhvdUp3VxQfk5sYYE:qK7pJizCbkY/CI8ZMhUpXQrYYE

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

b762956948eaeac8a187f01da47b1d89c0c5bb7295847b183a32ad7c083973b8
.exe windows x86

3fbad927aeb9f1ec50f749eaed9685f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtCreateFile

kernel32

TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ