b7a4fc49dfda5af126fe286ea417680dc6dc53e58054a0fbb65843f9a442fd66 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b7a4fc49dfda5af126fe286ea417680dc6dc53e58054a0fbb65843f9a442fd66
Size

387KB
MD5

21793997421e10e0d63a0edf09b0fd68
SHA1

1ccbbcba9fb4680f5f37321e39f9d4e1fc56f5ae
SHA256

b7a4fc49dfda5af126fe286ea417680dc6dc53e58054a0fbb65843f9a442fd66
SHA512

7d5b3b05b61fb343c044f91b8254e498915c2634d94064f57ad3d84678b421c587bada8a34aec160668a5e33d94bb1b4c1e0a868517698d6ab710b9508098aab
SSDEEP

6144:6/JGgm1cy+MJalZnWUyKyIozASoLT7CMNQOMXdkqG9d68TuaFZbHntgTOWlOj2KR:HcxMQlxYIozk/Cykdk736NAZzVWPe

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

b7a4fc49dfda5af126fe286ea417680dc6dc53e58054a0fbb65843f9a442fd66
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 433KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 513KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 852KB - Virtual size: 851KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE