a181ec6ef7f86071a3012d75bb87ed0b40b319a5d0ffd36e8077063351e5ba5a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a181ec6ef7f86071a3012d75bb87ed0b40b319a5d0ffd36e8077063351e5ba5a
Size

2.9MB
MD5

f52999d95292f588581c525fe534f188
SHA1

c01cb53b8f0345c3f1bf3397da2c692b69ea21db
SHA256

a181ec6ef7f86071a3012d75bb87ed0b40b319a5d0ffd36e8077063351e5ba5a
SHA512

9af57d6cda04924e688eab2c2750766d6063dcda91aedf9ed26b8e7d9da82a8589d096e9a2fe3a7ca7cbe771a5d3f5aeeff221f5475833494b5a67bc568e7b9c
SSDEEP

49152:J90uLRIWyjXvRhs9/dsEd2mOj4cc4aTyy4ON2cBjkfs30gDxeLRrCa8:EfWyjjg/VYj3UyuPBKs30Cxef8

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a181ec6ef7f86071a3012d75bb87ed0b40b319a5d0ffd36e8077063351e5ba5a

Files

a181ec6ef7f86071a3012d75bb87ed0b40b319a5d0ffd36e8077063351e5ba5a
.exe windows x86

61affb13325690893f1cd719154139e6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaStrErrVarCopy

kernel32

VirtualProtect
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ