3ec6e4ab5b014b9e18e327b86d88c0b8[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3ec6e4ab5b014b9e18e327b86d88c0b8.exe
Size

752KB
MD5

3ec6e4ab5b014b9e18e327b86d88c0b8
SHA1

cc1db644459bd41a97d797974108668848767554
SHA256

db39a6acb33e154d2e6daa02ceb6640f87c339691f7a61fb759c7353dd2c6e9a
SHA512

0a36fa0140df3bb637755d86cf857463b1ff69ea7278391bd0f76e46f621de58c6e332346c31a4579ee2dd28391f01f2f5c9240d23a49e70223509c9d1635610
SSDEEP

12288:/jTZsXcJUjw5c6tuTT3+ESGgNz/gjfyW8cJ6EbM+T2iz+XYDit0OEL/8:/j6MJUjQNtu3uE2Fgj78c8ET3bD/

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

3ec6e4ab5b014b9e18e327b86d88c0b8.exe
.exe windows x86

193d9a875066797beaf6fad953d502c3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetVersion
WideCharToMultiByte
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 624KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 728KB - Virtual size: 726KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ