ec1b771601ffad20b8c5cd5cf6ca82890951dbb71d24c34615e877a88ba19e8b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ec1b771601ffad20b8c5cd5cf6ca82890951dbb71d24c34615e877a88ba19e8b
Size

261KB
MD5

dca5fdf09069bb87cd53dca5099a3edc
SHA1

9a2581326fd1abe7d53558d5bf99865dde5e0688
SHA256

ec1b771601ffad20b8c5cd5cf6ca82890951dbb71d24c34615e877a88ba19e8b
SHA512

34866ea733bcdb496d9e333ebb88fec2fe4983172ee0ef55af245cb8be7332c27b1b3c6b1a6771662b56d2cef97d710a78108b6b317386e4a01b135108db65d8
SSDEEP

6144:b/89Ip8UUfguZkDxUrQtPzoKSI1A+nh/8M:b/89fg2rQtPUKS4N0M

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

ec1b771601ffad20b8c5cd5cf6ca82890951dbb71d24c34615e877a88ba19e8b
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 595KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 438KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 211KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 704KB - Virtual size: 701KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ