954db2c6ad13e8d8407a37512a0915fa09b9645163bea4344bd4d95ec8a188b1 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

954db2c6ad13e8d8407a37512a0915fa09b9645163bea4344bd4d95ec8a188b1
Size

424KB
MD5

5350a301da2367301641098c714e4ef9
SHA1

347bc9f0fde4b7e30e2676e64375822ff670a419
SHA256

954db2c6ad13e8d8407a37512a0915fa09b9645163bea4344bd4d95ec8a188b1
SHA512

8069b1ba9b5a123fa713e8886b7e320e1fc608f7ce20cf95839d7acc6dbeef96d62c8edbd743128ecc50b530fde756489ad3689e67275122c2f061882468ef0e
SSDEEP

12288:riGQKNNyxxNNNehbNeeeMo11eo3ZGUcApkGOFG4frVy2IvTy:riGQKNNyxxNNNehbNeeeT11eeGUclGO/

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

954db2c6ad13e8d8407a37512a0915fa09b9645163bea4344bd4d95ec8a188b1
.exe windows x86

11cbdfb47fdc9152560598c88ea044f0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

LoadCursorA
MessageBoxA

advapi32

RegEnumKeyExA

ole32

CoTaskMemRealloc

oleaut32

SysStringLen

gdi32

GetStockObject

ntdll

RtlFreeHeap

Sections

.text
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 168KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 255KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ