b27088018e38ce6ab1d4f0cc577d8893a6a093dc84f5b01e02b61fe5b718cf03 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b27088018e38ce6ab1d4f0cc577d8893a6a093dc84f5b01e02b61fe5b718cf03
Size

144KB
MD5

7a1695ac844c4523cb69230e7d67a361
SHA1

5f77572fe31fdd3277eb20229e9861491ec42ad5
SHA256

b27088018e38ce6ab1d4f0cc577d8893a6a093dc84f5b01e02b61fe5b718cf03
SHA512

06682d9fdcdcad5b367fe62e2665c31c71163fb9a96abec82e10f909aaf9e8c085e7bb490d0a66759dc754c3fbb37ece4f9bb2d44a48ea310420e36da77f6b72
SSDEEP

3072:0OmDO1tSrFFfnwbhu9FK0s6sw2429W0uXTTwb5h8p8GOO/iygt/:pq9Gbhu9cD6324D8b5EiD/

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

b27088018e38ce6ab1d4f0cc577d8893a6a093dc84f5b01e02b61fe5b718cf03
.dll windows x86

98cf60a8e72188ad351a57890bc2fd12

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetSystemMetrics

gdi32

SetMapMode

advapi32

OpenServiceA

Exports

Exports

LoadUnhookDriver
UnloadUnhookDriver

Sections

.text
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ