1a910a2b9385f687d4e40cd09fd06704[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a910a2b9385f687d4e40cd09fd06704.exe
Size

788KB
MD5

1a910a2b9385f687d4e40cd09fd06704
SHA1

cd84f9887b0c4b744e4a9e8066958a67ecfedc6d
SHA256

48747eb42f528ee4a9fab6fdac0e431a2cc6e4ba6ba10fcf62211c959e102efb
SHA512

558c5bc2c7870f5d932f7d0e02bfbc3d55551afb387038a9eb7e571a33bf567cd23fd82707ddc0df36576620427bfdd1ba1ffa211fc6a7e0b56f695982b23b52
SSDEEP

12288:piPHQcZGqOInle3iT6JqVlDkqKZkTwCRCdFfQlZcmsvM68y4uOspidGXZ:piPwGBOIng3qw6hskTwB/zZB4ap/

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

1a910a2b9385f687d4e40cd09fd06704.exe
.exe windows x86

11cc54a9a29ceae337a5d3a9518624c5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetVersion
GetLocalTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 665KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 764KB - Virtual size: 761KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ