20607f005161fffd746f17640a0ef08e611c4c91f4fa8a7dfae4f691db259eac | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20607f005161fffd746f17640a0ef08e611c4c91f4fa8a7dfae4f691db259eac
Size

776KB
MD5

eb10fc9c3731edcc7dbc2f674f09f722
SHA1

31b81c9f1b04ae191276c5c6b4c9bf3c20ee08c7
SHA256

20607f005161fffd746f17640a0ef08e611c4c91f4fa8a7dfae4f691db259eac
SHA512

be667f93092763b39ae8e2a080d1289d70e5d654c9fcc8394729a0e5e45b7494e6ee05e19b5efe26032b1f29d970f3df8b806878c88ef4c2eb101aa8d38a13b4
SSDEEP

12288:qS/T6SOAGWzFWqgu85hwadkhBGJ6gP057owcLwtz0IL7KalFa9Mqelv55QOR+H:776SZrFWqj88amOLsX7zDL7p4Mqelh3

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

20607f005161fffd746f17640a0ef08e611c4c91f4fa8a7dfae4f691db259eac
.exe windows x86

405dee65443c008edc68491332181ab1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetVersion
EnumResourceLanguagesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 649KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 752KB - Virtual size: 748KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ