741d5827be94b455cb0d0ea3fe2437ce011e1887b17ab5bbedf56644d8284d91 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

741d5827be94b455cb0d0ea3fe2437ce011e1887b17ab5bbedf56644d8284d91
Size

764KB
MD5

02cfde0c92fdb9777b730e9cf8fc2183
SHA1

cbf47d55b082b838d540c3ad59d1d99eae302481
SHA256

741d5827be94b455cb0d0ea3fe2437ce011e1887b17ab5bbedf56644d8284d91
SHA512

2344165eaaf9482378f0a2edee363af397a2e78be7df88747ff3bbc69620d00890223ce6409603c64660ff36056c6c24dd9938578785806dc3130ec09da7d57e
SSDEEP

12288:gMIKawfGguDXNvhAF+/MnxEDzvjzKxn4SpitJyTjdHHRx7oLzP/n5UyzipP:gMlabgyZeV2vPQ4SpQyTjdHXqzPW4i

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

741d5827be94b455cb0d0ea3fe2437ce011e1887b17ab5bbedf56644d8284d91
.exe windows x86

6a111694076839940cfa4e5a446216b7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetVersion
UnhandledExceptionFilter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 633KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 740KB - Virtual size: 736KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ