a4158134f2eab75dbe6e7fca4fa27609e853088ae603324e8159a79b5ca35435 | Triage

Sharing

General

Target

a4158134f2eab75dbe6e7fca4fa27609e853088ae603324e8159a79b5ca35435
Size

117KB
MD5

a2387d83f9526c151d8eae731073977d
SHA1

04994daeccd157fa001f4f96591aac7127486f4b
SHA256

a4158134f2eab75dbe6e7fca4fa27609e853088ae603324e8159a79b5ca35435
SHA512

8b14f4ffedc65f10096b0cdc973fd2e6c9ee2241cc5696166947555b1ba3e9689d179b5557aa1a2acbbf6a494335fb37c80d88c2378d18f9e8bd81d3792de141
SSDEEP

3072:BSJ6PYdZpkLsHJGKLfRoHwUIcRbLze2nmzSnOs5:IZpHpG4fRoQUBeHSnOs5

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

a4158134f2eab75dbe6e7fca4fa27609e853088ae603324e8159a79b5ca35435
.exe windows x86

c04ac1a6b33b93c064bda89be5b2fa4d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

shell32

ShellExecuteA

ws2_32

send

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ