8bece3c7ba172e1093b020c745236ac7d9dc8b74595f78d27ffb804add5b7833 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8bece3c7ba172e1093b020c745236ac7d9dc8b74595f78d27ffb804add5b7833
Size

824KB
MD5

109de725c1b88899e8957be75754abbd
SHA1

971b0dc4f0b5472099d75f29c2d749adf0a895ab
SHA256

8bece3c7ba172e1093b020c745236ac7d9dc8b74595f78d27ffb804add5b7833
SHA512

a01e0878acb8366acb31490d32b3f3adce5aa291416c9ea0ac8ef19fbd6accc50b8780d1a1892084719d4c33213905c4c868bbb301c189c111d961ce3d4b86c2
SSDEEP

24576:kVM4MGDjO6gSoLg40isUDut3fnIV0olQI6Vo5:UTB+3Fk40isUDut3fnI9i/e

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

8bece3c7ba172e1093b020c745236ac7d9dc8b74595f78d27ffb804add5b7833
.exe windows x86

20ce5f8c9ad6554d93fa14df0e31840d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaLateIdSt

kernel32

GetTickCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 758KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 812KB - Virtual size: 811KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ