ffdroider | 1456-197-0x0000000000400000-0x0000000000651000-memory[.]dmp | Triage

Sharing

General

Target

1456-197-0x0000000000400000-0x0000000000651000-memory.dmp
Size

2.3MB
MD5

d3d0f9e7e95e4eb339f37a79b176e8f5
SHA1

105460b855da194cb07de240522b20f0d6209c73
SHA256

b704c8a58911283c783d320f0c5283bc413fccd2efd8039a2eb3f54dedc99880
SHA512

50d9aabc5d7ce1f850d13774fd74489a647992ce652c4d6f916d93fda1160ced80beae5f820f1e186a18e0198f80a7bf5f07603c7a71c59c896f3515104bf8c2
SSDEEP

49152:GBaOLIa+E11y10VthjRn6iLyafKvLVr+XTVzLZ2Li4iJsvlAP1I0Fx505F0L/c:d6+EXy10VjVqUzLZpJQA9I0Fx5O0Lk

Score

10^/10

vmprotect ffdroider

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Signatures

Ffdroider family
ffdroider

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

1456-197-0x0000000000400000-0x0000000000651000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 786KB - Virtual size: 785KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ