Spectrum[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Spectrum.rar
Size

2.0MB
MD5

321b819a5e129502ab8c4147880e2e33
SHA1

9aac456a095b2dcadde572ed86262e869b510d96
SHA256

8788bf31e6749144762d4cb9b423f9ad45a70026e0368566e6b788181443e662
SHA512

9a86db539b83b820e3be5b82a90607489e798be4eb254c57189c0403ef7d965d704f47d74586dd11e20431309a1b4c9c34b94a497c82b89e465567a46f24b134
SSDEEP

49152:uqNEnEE2Vl4vJpcKBNEhvR3jHlnUGs1539CiFNEDA:pNEEInTBNkXU9339vNEDA

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
static1/unpack001/Spectrum.exe	vmprotect

Files

Spectrum.rar
.rar
Spectrum.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ