b9029caa9f0ef536f1ff324b1dca0aee48be72868d869f0ccda8bb13faa46d71 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b9029caa9f0ef536f1ff324b1dca0aee48be72868d869f0ccda8bb13faa46d71
Size

64KB
MD5

e19df81938652a7d57aaf69d6c5da8bb
SHA1

de2c8ea3510ee3878a6dfba11d4d4a9f884c9009
SHA256

b9029caa9f0ef536f1ff324b1dca0aee48be72868d869f0ccda8bb13faa46d71
SHA512

e353334e97fe76d11eb23ae9e2dffe44cfe57cb62a8f10b4d3e34bb9021533654ef925cfe6197e2a8dbd82e609b296325e752284957a258c653023b4af09fef4
SSDEEP

1536:pkIOCjrCrJhl7witeR931CXa5xEzKyIX:pfCdv7lteR9saEmyI

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

b9029caa9f0ef536f1ff324b1dca0aee48be72868d869f0ccda8bb13faa46d71
.dll windows x86

e0e7f203e3694cf1c5e1ca006f16aea5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

MessageBoxA

Exports

Exports

1
2
3
4
5
6
7
8

Sections

.text
Size: - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ