8dd0759c6ab2faebcf7b18902f776ce9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8dd0759c6ab2faebcf7b18902f776ce9
Size

732KB
MD5

8dd0759c6ab2faebcf7b18902f776ce9
SHA1

b7498637968a28755604c53a564309b0a8f2aafa
SHA256

d8cb8d820696881f03551006f07d44f4be052f9551a1250a985f8470c0edb3b1
SHA512

97c298520fb4cfbfb991c966b5cedd1c515fe759a5e0913c89b6e8ddd7c7d97ee652e72ab4bf9ae7a66704f1a8c6750f4fffcb9e6942aaa64ee5647e7dd06720
SSDEEP

12288:RpcKFeOp3M+M+VlTcA+4Vrnv+CR9nvD9Xea87vorjIDcRmiG8pGfCnMikBVr:jr0lglTcr0bWA9C7lLAMZb

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Files

8dd0759c6ab2faebcf7b18902f776ce9
.exe windows x86

a320e29878a432b145f8a790e7e10f17

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersionExA
GetVersion
HeapAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 612KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 708KB - Virtual size: 706KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ