5e616003629c8604e0345f7ffb0902c641438ea73ad692cf1e2100e5560a6e0c | Triage

Sharing

General

Target

5e616003629c8604e0345f7ffb0902c641438ea73ad692cf1e2100e5560a6e0c
Size

3.5MB
MD5

61f42ae7c6cd1248603f3b08945531d8
SHA1

760a9f9d637162f32067e26ffe09c0c3a6e03796
SHA256

5e616003629c8604e0345f7ffb0902c641438ea73ad692cf1e2100e5560a6e0c
SHA512

cb5195c2812aa8399a94b9612831622b88e180f0f08c6e93dca0ff9279bde029d129cac43ccfe4aada61ac974839d93bff6869db2a8470db1c5131e9626ed4dd
SSDEEP

98304:x24VE5Y4uoPVXFdSvpD9Z30L1+6XJwVsQ3djtravOkW:x2YcY4uOVXFdSh5d05+mvW

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

5e616003629c8604e0345f7ffb0902c641438ea73ad692cf1e2100e5560a6e0c
.exe windows x64

ac639288a9537d81bbe3cfbc1135d815

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ReadFile
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

winhttp

WinHttpOpenRequest

user32

GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 945KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 469B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ