4e239eeb4ab25b87618d61f8b4a5d0ac8279f7fb61968186dfe5359b5a5fb8b5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4e239eeb4ab25b87618d61f8b4a5d0ac8279f7fb61968186dfe5359b5a5fb8b5
Size

143KB
MD5

2fa91a07c8734fe5c5302af424f71840
SHA1

c563fe19bf9ab07507762fb1b2e27db7a1ef7715
SHA256

4e239eeb4ab25b87618d61f8b4a5d0ac8279f7fb61968186dfe5359b5a5fb8b5
SHA512

32a7182f65d6c83466a557c1355e95160b1a94865020af68b2c359267d8d524f27dc47a5ac9f88375665b27eee5fd57af15dedc3f5cfa3e037192fd1c0b868fe
SSDEEP

3072:+k+BC3K5eqsJR4Ew9pXaa6HoQsgYxWoGgS8zDJJ+JZCytWJVO:/K7sJRk9QMHICytWJV

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

4e239eeb4ab25b87618d61f8b4a5d0ac8279f7fb61968186dfe5359b5a5fb8b5
.exe windows x86

465d26967af1346f094e36253f9c8f2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtSetInformationFile

kernel32

WaitForSingleObject
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ