PBZepetto (Mr[.]Cheats)[.]exe | Triage

Sharing

General

Target

PBZepetto (Mr.Cheats).exe
Size

1.2MB
MD5

776da1de3aaca59dd2d670619504f333
SHA1

aab3e6ca7eea19b8b2437554ae5057f02f4b3814
SHA256

fa4aec40b19421eddefdf0e5686581df51629d2229597bfeea7dec33d4c4d1d7
SHA512

bbe7b21f50e436a05de62cf3ea9162a85a8f585cd3f2e3c4c6431209aece6e06c8fd924471c42fd38bf4dd5525d9ddaf6d322b49be449233a5a8c2b01dda5af4
SSDEEP

24576:552hbNhErbR1xcUNqr9tJ3TDEzWFPdXwHEBOEfQdT5YBFMx:552hbNhEPR1qwsB8zKVAkckK

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

PBZepetto (Mr.Cheats).exe
.exe windows x86

d7c82452bb3a6ce183763188181c290f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_adj_fdiv_r

kernel32

LoadResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 961KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ