c2033dec849b6b74f702dcb8c7834f2f4f02252d71f83cce7547de1d9f5b309f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c2033dec849b6b74f702dcb8c7834f2f4f02252d71f83cce7547de1d9f5b309f
Size

772KB
MD5

13121bfc6d8b0c426858b90bf70d2dbd
SHA1

7668c6998e375cc85a3e89e649439123f7d5ffa3
SHA256

c2033dec849b6b74f702dcb8c7834f2f4f02252d71f83cce7547de1d9f5b309f
SHA512

cbb92ee648f86eb6b03a739bd7cdf15d75032d4d82f518699eb18ac12ddc8f4726b1f397ff23884623dc543e7f50b194b4d836d8594b4cba54b0c7c650e88137
SSDEEP

12288:lXYRQCS7xa4vqngIIY+I13IRbH5eXfD2tMERuAhyWWSXwxHQhrz8igj/Dk:VYa3s5KIMZevD2lTDWSXwdQR8iSr

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

c2033dec849b6b74f702dcb8c7834f2f4f02252d71f83cce7547de1d9f5b309f
.exe windows x86

34a07490645ba2ca438ebef54db1cbbd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetVersion
GetCurrentProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 644KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 748KB - Virtual size: 744KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ