2bd8ea9459837f496b46ef5c30dab851b1076b8fb6b5898ba985ae4d06a8a9c6 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2bd8ea9459837f496b46ef5c30dab851b1076b8fb6b5898ba985ae4d06a8a9c6
Size

1.2MB
MD5

bfcb1f635f9b8dff9cfba350d52f7c3a
SHA1

6643149e1262c7cb204f42e044c5aa46100ff52e
SHA256

2bd8ea9459837f496b46ef5c30dab851b1076b8fb6b5898ba985ae4d06a8a9c6
SHA512

2cde2593a5a0efc23a95d5946c4ba3ffab53b05474f6a5a96c570212cbc8b4272c2ee8354ac46cb0d800ade6ebf018f1a501dc4e59a36dddce86d70410b0f80a
SSDEEP

24576:C7cL3Hn1x9hubcLagEcwtA9I8MiiGO5uSZvnrUQMU7nvQW07PJqjx/ApmQ:CUb9hubcLvELoQGO5NfMavcUJ

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

2bd8ea9459837f496b46ef5c30dab851b1076b8fb6b5898ba985ae4d06a8a9c6
.exe windows x86

3ec011ac1ba2f7d87c72c1ddea671c09

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord1146

msvcrt

_acmdln

kernel32

CloseHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

LoadIconA

advapi32

RegQueryValueExA

shell32

SHGetSpecialFolderLocation

Sections

.text
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 29.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 984KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ