4fa5ff0fdd21a3f03656679af2cd8bb7[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4fa5ff0fdd21a3f03656679af2cd8bb7.exe
Size

772KB
MD5

4fa5ff0fdd21a3f03656679af2cd8bb7
SHA1

699bec208744d47f79ab1fb52558e71d4f257734
SHA256

816a070a221056e61d0dadd4f5cabab3c96394da789e19c7950b170cd128effa
SHA512

c3a3aaa7b76193dd929153125f4368bc28bf04f3ac1c02a68b69ae49182819a09fbcb0a9063d6626d400d93390001373be6b39a9156afa2e6a3e4c8899584cff
SSDEEP

24576:X4C18n6NDUI6q0zmZIi1LA6dHNeXN9ZtrZvVqqW7dR:XlJUI6qNZIi1JHNeXN9Zl9VzWT

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

4fa5ff0fdd21a3f03656679af2cd8bb7.exe
.exe windows x86

7e52b8fd7312ccfb7f0d5987018225da

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetVersion
HeapAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 647KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 748KB - Virtual size: 744KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ