09de80bbf0d3f548a3e1f559dcab30153d2c13186b961ec0bcbc4c532dd68901 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

09de80bbf0d3f548a3e1f559dcab30153d2c13186b961ec0bcbc4c532dd68901
Size

2.0MB
MD5

ea38926853a7e55f39468a12551ae3f4
SHA1

94ec2a098f0f868f5da1a51bce2e6e51c7b395fd
SHA256

09de80bbf0d3f548a3e1f559dcab30153d2c13186b961ec0bcbc4c532dd68901
SHA512

d65a17a33f7642bce88d51adb6c2bc3cc40f851a8f481eacbada1dc449806ab41a217b26eeb6886f218607e652c9bb932d25541643359c84e22a09c4ec2b29ec
SSDEEP

49152:tloR4mgNS9ZIMDWWRfxwVygiZfdDwY6H/yWcXzWK:AamgNmZZDF6kflwYQyX

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

09de80bbf0d3f548a3e1f559dcab30153d2c13186b961ec0bcbc4c532dd68901
.exe windows x86

c6d0baa33a7c8dea720e37cb6ffecd84

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

wsprintfW

Sections

.text
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 816KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 512KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ