c2cd7e5ba5c6f538815f542084eaec7538bce42d39234df7497bee341e70b0af | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c2cd7e5ba5c6f538815f542084eaec7538bce42d39234df7497bee341e70b0af
Size

732KB
MD5

8f3ed399910f9dab16aacb4089f15373
SHA1

27d14bcfe641f02ce43a156872d2156a45595025
SHA256

c2cd7e5ba5c6f538815f542084eaec7538bce42d39234df7497bee341e70b0af
SHA512

b89d6b496bc01fef7b7f86f7cb3d86e748bffa7e46af37f546a558a35d9d0f577b823bddfe706b6164659b1221aa8b6afc5dc22ad4d3e52a1d1a0dc15cd964e6
SSDEEP

12288:lG8GebTtQT4Lh2/PcBofsL4C2nbJITso6iwfkIMAAT32T65+9lV1mIE12tsSAU5s:l6ebRQUdNoffFUv4cIMAc3s65qwIE12y

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

c2cd7e5ba5c6f538815f542084eaec7538bce42d39234df7497bee341e70b0af
.exe windows x86

23fedb867d8fccad8f607bd2ebd11d90

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaStrLike

kernel32

MultiByteToWideChar
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 283KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 578KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 724KB - Virtual size: 720KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ