f1b3ea6953728c7880d195c8fda1fe19 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f1b3ea6953728c7880d195c8fda1fe19
Size

644KB
MD5

f1b3ea6953728c7880d195c8fda1fe19
SHA1

6aa6d12c153822b8f14442084f1488795ab324ed
SHA256

e130cbb5904ccc07db198505434092ae6967d4ed7c271ed0630998f504c50580
SHA512

094af94838614bad57a8d47bdf09874ed919ff9948ba934b2816b6af172710a67c948c1abe349990e4c3d00b93d0f715571a856b5b7893f66d269b6b55f6bb54
SSDEEP

6144:5OYVfDFsJtFe+N/x3NOajQYTmff5yJ+e24g9I+1mIWdtAiiGJNbzvE:UYVf0tFesWWCy+EUs

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1b3ea6953728c7880d195c8fda1fe19

Files

f1b3ea6953728c7880d195c8fda1fe19
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 348KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 543KB - Virtual size: 543KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ