6c6f17beb28812c0587d6724decc6bfb[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6c6f17beb28812c0587d6724decc6bfb.bin
Size

10.9MB
MD5

6c6f17beb28812c0587d6724decc6bfb
SHA1

4440551060c3de12a47ceb63fe0b1b3de932ac2c
SHA256

a571365ff658a22ac015ff0dad7e664a9e8024ebe9e9f97688b77a82077335b4
SHA512

789d6a37522567860d15c47629dd51719b5de0089f6c7f911209e2ec66de100706e4f81145d489548cdcf6f91cec4e522545f9acb574baa58bb5fea85a596c6f
SSDEEP

196608:JoHq4yCxjeKKJgEBI0ttKQDM+J0ijl+K5m4UruHI:FojeK9EZUQDvJ0wOruHI

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c6f17beb28812c0587d6724decc6bfb.bin

Files

6c6f17beb28812c0587d6724decc6bfb.bin
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 10.9MB - Virtual size: 10.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ