548346392638f865a95e274872e6afb08dbe6951db5f3932fb5cced90083d1bf | Triage

Sharing

Copy URL Twitter E-mail

General

Target

548346392638f865a95e274872e6afb08dbe6951db5f3932fb5cced90083d1bf
Size

752KB
MD5

7d41df159aa91f4019ce9bcec8ffe630
SHA1

8c193aa511506d38c779e27f8b68dc006afb75e8
SHA256

548346392638f865a95e274872e6afb08dbe6951db5f3932fb5cced90083d1bf
SHA512

444555ab1204873e2096387fc90bba42cb058e96ded093f47aff5befb91ead2df012f478f8f4588ee32ce2951020e214a9737ca2c702225b6d749e9f81239ce9
SSDEEP

12288:Ags1R7erNfrFjcSkULhzHDO3IZVWHfN5FM8tOKQM2F89t/:Xs19e5frph+WOfN4nKQMft

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

548346392638f865a95e274872e6afb08dbe6951db5f3932fb5cced90083d1bf
.exe windows x86

2025a79386cf0c2ef968fd895179689c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetVersion
HeapReAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 638KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 728KB - Virtual size: 725KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ