a2f5ba24aa6e0b246e1f989f6334c2989f6e672ed86ce3b87aadb62cbdebdda2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a2f5ba24aa6e0b246e1f989f6334c2989f6e672ed86ce3b87aadb62cbdebdda2
Size

199KB
MD5

fa8d6da268fd19217776b9f2dba349a1
SHA1

8b815c15b186014e424cce54ba09dc48b5053990
SHA256

a2f5ba24aa6e0b246e1f989f6334c2989f6e672ed86ce3b87aadb62cbdebdda2
SHA512

491198c4ebb31260e1f19ab3d3275bef16cc089b37bb5aa61f27c65701773374fd4476e80b053847ed249c401299104e6eabfca3bfc4115edd1e96e5f8bb7128
SSDEEP

6144:8K7PQfbcqWBT7tH6XUn87ZCbVu/u2/fn:xLqWL4UHViZ3n

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

a2f5ba24aa6e0b246e1f989f6334c2989f6e672ed86ce3b87aadb62cbdebdda2
.exe windows x86

3fbad927aeb9f1ec50f749eaed9685f3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
MessageBoxA

advapi32

ControlService

ntdll

NtCreateFile

kernel32

TlsAlloc
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ