24d63959370d1ddb6e0730cab69e7c9e08ebc13c36f0eda49741d22ae63db3af | Triage

Sharing

Copy URL Twitter E-mail

General

Target

24d63959370d1ddb6e0730cab69e7c9e08ebc13c36f0eda49741d22ae63db3af
Size

1.9MB
MD5

57da2b0a59a5e6b6ca12cf4f422f1877
SHA1

594f8bb3b7ca2752e6219b3e2eeee97a9acb907f
SHA256

24d63959370d1ddb6e0730cab69e7c9e08ebc13c36f0eda49741d22ae63db3af
SHA512

72f51b33fef45297dd32c3e888d4f85628e59442556a6f2a33061c8de121a4ddd6e538435fd83d856705f16285975a5c18b370b0bd9cf8262c1aa78049a76390
SSDEEP

49152:4UxZd/e7f6B8SEVrk6+ca1GAMtV0TAozUJ6C:4UxZlmyBtERknlVAoz2b

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

24d63959370d1ddb6e0730cab69e7c9e08ebc13c36f0eda49741d22ae63db3af
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 879KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 8.7MB - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ