afc4d286b6199a9c8ac35cde8511656e64fc19d29497e8a4509e1612f1214c7d | Triage

Sharing

General

Target

afc4d286b6199a9c8ac35cde8511656e64fc19d29497e8a4509e1612f1214c7d
Size

2.5MB
MD5

4984d638b412fd2371a2934368b1769a
SHA1

3ba21d9895e7ce24f6b499318f8228ef7649e845
SHA256

afc4d286b6199a9c8ac35cde8511656e64fc19d29497e8a4509e1612f1214c7d
SHA512

385c2c9a4865aeaebded872ca7ae01705196c16bc82c2d232706762fc3ba0d9107f3f54de05b0d1445a5b29a70aea1d5552da27930b9840a2b3edc339064aa4c
SSDEEP

49152:hgFstei+6W2AJTqSvKRB/8+UOLmbBfj2DOMtE75O9K6Ud57YmrY:Ast5+P2AHH3gmJ9qKHL7frY

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afc4d286b6199a9c8ac35cde8511656e64fc19d29497e8a4509e1612f1214c7d

Files

afc4d286b6199a9c8ac35cde8511656e64fc19d29497e8a4509e1612f1214c7d
.exe windows:4 windows x86

e61a25e4f59709ecfae215cb738f02d2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord2554

msvcrt

_acmdln

kernel32

FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

ClipCursor

shell32

ShellExecuteA

msvcp60

??1_Winit@std@@QAE@XZ

Sections

.text
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE