e1e23f05b54df34aa55b0f7738462d300ef9f064044c780fa2e0858d9c206c8e | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1e23f05b54df34aa55b0f7738462d300ef9f064044c780fa2e0858d9c206c8e
Size

4.2MB
MD5

df2e8291c9684c29b5bace8e9e94cb17
SHA1

df744b1c71df645a2e89376c30cdcac21434c4f7
SHA256

e1e23f05b54df34aa55b0f7738462d300ef9f064044c780fa2e0858d9c206c8e
SHA512

09359fa7e350972c3c51542a2673fd0031f330fee88e2d997652fb57a293bb7adde2876749a9218d3aae5e42e62c25e95c6cd3615753e40865b5bff84b54908a
SSDEEP

98304:NC89EMEZyoXM2xAVkIaoLNItrUvMRA+2TbZAao+kd9fhVN6:NCgrEZ/8nVEohItrUvd/HZJkdPv

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

e1e23f05b54df34aa55b0f7738462d300ef9f064044c780fa2e0858d9c206c8e
.exe windows x86

597853cb1d66d511f29ba5cc7cef46ac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

kernel32

FreeLibrary
GetModuleHandleA
GetProcAddress
VirtualProtect

advapi32

RegQueryValueExA

Sections

.text
Size: - Virtual size: 556B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 8.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ