887ecfe083d182615252ca59c6ffb61d[.]dll[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

887ecfe083d182615252ca59c6ffb61d.dll.exe
Size

727KB
MD5

887ecfe083d182615252ca59c6ffb61d
SHA1

ce6e342b67c482077b13a2741c36eec37ef14fc5
SHA256

00191a06c41efba700b65f8990080808db245f7177c1fbed33bee14d415c5ae9
SHA512

de37fbbc328e94ed1519e81393195454b3c0e5d2ddd961706f5e75b561cd0902473fe1abe9aeadcb6760cd49d5871018fc99f7d4f46f1d3110c8ce56b85e5314
SSDEEP

12288:i22dTyc/0Katarup8g1qC90o9rskxrykVxTs6K9Vsgu34hoQUvdBNYhNXupDIjBd:i22GKaECp8G90o95vVx46KrsgoF2Xu4r

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
887ecfe083d182615252ca59c6ffb61d.dll.exe

Files

887ecfe083d182615252ca59c6ffb61d.dll.exe
.dll windows x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.text
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 595B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6.4MB - Virtual size: 6.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ