a9b72e60070a9224b81ad12c7af42bfee12c482bfd83f965c04c95de5ff15910 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a9b72e60070a9224b81ad12c7af42bfee12c482bfd83f965c04c95de5ff15910
Size

156KB
MD5

b73fd772f73363b6ae8c2d306f893200
SHA1

62a3303cbe687e2fa7622f19b6ce4e562e1f9442
SHA256

a9b72e60070a9224b81ad12c7af42bfee12c482bfd83f965c04c95de5ff15910
SHA512

bd701424eb5024e13352a7dcf4ae0b58f80143bfe6e54c99c7703ecb7783fb3de1659c09c3446494924766b7d485461a2ffa7e5aad7a3b48b0c1204fcd810178
SSDEEP

3072:wcUvTMnCfppLWgtX0vpTLTgVdQKw3SMXeZHFB5CSN7ILr:Y4Cfp1Wg90FL1KYqlZN7IL

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

a9b72e60070a9224b81ad12c7af42bfee12c482bfd83f965c04c95de5ff15910
.dll windows x86

c554b7f02c647beff9d0184ce4a1c60d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenFileMappingA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

FindWindowA

advapi32

RegQueryValueExA

Sections

.text
Size: - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ