9a08bf861b906006dd339cb63d78384e88f4700c4d16df9e9245d37d5b37565b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9a08bf861b906006dd339cb63d78384e88f4700c4d16df9e9245d37d5b37565b
Size

203KB
MD5

5a3f16d8aa78451cdecf5bd04a43f704
SHA1

bde795d4661dc4afa925188937bf4b61989d69c2
SHA256

9a08bf861b906006dd339cb63d78384e88f4700c4d16df9e9245d37d5b37565b
SHA512

0fdd627da10b259c7fe7e050fc8e9ce78c1ba576e4bdb4e072a373e030970cd8dadd2ef59cad6b7605157f23435b2807afd9c0f246448cdba28ae5acfdf6bb47
SSDEEP

3072:o+BC3K5eqJX3Ye/f36Cz9RLFVIIVelNlKUR0CfW8ei846Rrn8HuEkFS3j0NwsR:AK75YeKCZRRVII0lvCCfRecOnUu00as

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

9a08bf861b906006dd339cb63d78384e88f4700c4d16df9e9245d37d5b37565b
.exe windows x86

3fbad927aeb9f1ec50f749eaed9685f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtCreateFile

kernel32

TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ