a67cd0be90c23750d82fd6ca6c6f8a82b9c62da0390f95c1377cb85ac4db16fc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a67cd0be90c23750d82fd6ca6c6f8a82b9c62da0390f95c1377cb85ac4db16fc
Size

72KB
MD5

9c9a709cc7c6f18bde7995d88ef1b59e
SHA1

391cb2c06ffd8fe3d8c963a7cfd213634081a7d8
SHA256

a67cd0be90c23750d82fd6ca6c6f8a82b9c62da0390f95c1377cb85ac4db16fc
SHA512

02e8d0a3eb537e99e2b778478d1d260b0de6a69791f72fc351b913ed7718928215dbd07901d294d7845bbbb0ec4d80d7fe97014b641ab3ac710dc1c93d578082
SSDEEP

1536:XrRDmu4Xi5lv2+XuXlM4IhrJmy8ZyQ/AVMfjOtJAFGkylXsqEFeye0rHL5rh:bJJv2+e29lmyBVujOtJyss33eor5

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

a67cd0be90c23750d82fd6ca6c6f8a82b9c62da0390f95c1377cb85ac4db16fc
.exe windows x86

f7be333f595616b73a99e67ea63157ad

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

ExitProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

advapi32

RegCloseKey

Sections

.text
Size: - Virtual size: 556B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE