12adf57db47b1ea0fbb2a30aa8177fd5f48fb3c6885f68d48f99bb5effe0dad2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

12adf57db47b1ea0fbb2a30aa8177fd5f48fb3c6885f68d48f99bb5effe0dad2
Size

561KB
MD5

6f8ac15f4b397563d1655b03cf3c8477
SHA1

13608a0c78fcc372c235599bfd04ea49f1c92872
SHA256

12adf57db47b1ea0fbb2a30aa8177fd5f48fb3c6885f68d48f99bb5effe0dad2
SHA512

0a1279fb78da5c6cf702a0e09d796f709cd5b2f6ac5b995a66810ce6f71ec8493a65ed063f4fbab61c61bf8db7302159c350ee9aa152ba5f232151787beaded8
SSDEEP

12288:1Ed9KVBYhEwcYZLsgYWweujWJUm5/+HtecUy+hy5cYi3eeTEu2/Oc8j3toqC:1aKVBYhEw5ZLsgYWaWJUmA56U5jmEu2n

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

12adf57db47b1ea0fbb2a30aa8177fd5f48fb3c6885f68d48f99bb5effe0dad2
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 484KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 281KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 321KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE