bpaz[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bpaz.exe
Size

1.2MB
MD5

95c3dae893acf59e7e3dffa7b11dfe9c
SHA1

df9d0f6ed1bce85ce8ec8a3baa0e09284aa6ed2c
SHA256

e1951dbdfefb24f7a14956233992982d9e293b8274305270d6641e3eb125896b
SHA512

b45e99178baf5869e2bc155171e2d91970dc4060f7f06dfd2e8b88a959bb280d79c1f664623c96fae5e0219f811d0c740b8eba079279da520b6490dda47628c3
SSDEEP

24576:WybG2smcHnxgzrFVjZF6uzxShQgibFRGALb7Mv:pCucKznxkQpxJLH

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

bpaz.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: - Virtual size: 739KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ