stringless[.]exe | Triage

Sharing

General

Target

stringless.exe
Size

2.6MB
MD5

7fb60ff8c9849f18a1cec88180389ef4
SHA1

4e7633c8e3b9b23a63e89b41f47918dbc7f78059
SHA256

d3f0b6a5e1797be376a82e6887f414cfb448e4fcc87d9d42c2672b387f0e1f3c
SHA512

12237d943a687ff3af4064d2870eebe13d1cfbf70147270b39f7d400ec5a1ad069754236759273045be7f0e41e73e539076a7202605f45b45aef979af90178d1
SSDEEP

49152:pDCmaU6plqLgopWRS0n9q6/XGxlbEPxlBst4naV4ZVTp:ppaplDS09pXGxdqbWUTp

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

stringless.exe
.exe windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ