5c2d27b200620b49f2a0f64ad16deeb0dfd2c83af2c5c91cf4a989876ad1aecf | Triage

Sharing

General

Target

5c2d27b200620b49f2a0f64ad16deeb0dfd2c83af2c5c91cf4a989876ad1aecf
Size

723KB
MD5

7b0335ff377052a85588eb58790dcac0
SHA1

4126844c4084d6caba5f8da8287ed987afc8023f
SHA256

5c2d27b200620b49f2a0f64ad16deeb0dfd2c83af2c5c91cf4a989876ad1aecf
SHA512

7a4d4b64d7e3ae77fec98b24e544fa948927913a2c887b863327258e7cbe8339e58914657d74165774cbb31edb387bf0f7c7f9a0e22394079adb29312ded9d01
SSDEEP

12288:DOuLS7qap+gPCqrtjkrv1u3B/CWZoAHreMGCEVftppPADMAMDhxi2mE27B8uNPsa:DHxaMgPCqBwZu3B6Wrg9VxADMAMtxdmd

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

5c2d27b200620b49f2a0f64ad16deeb0dfd2c83af2c5c91cf4a989876ad1aecf
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 480KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 908KB - Virtual size: 905KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE