0e2dbabf16774d49dfbdf92a54f513b7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e2dbabf16774d49dfbdf92a54f513b7
Size

243KB
MD5

0e2dbabf16774d49dfbdf92a54f513b7
SHA1

30dbd6b573ce775607203557c2c63e533b4d2739
SHA256

ed4ef1f4751c54790ddff9ef215e40bab29ea43077295315283d0aab991547dd
SHA512

fa1cfff3e247572faad07dc3264516c1463d1df78b55ad19f9909e2616e5b12a30b945275e07a32786932528d7a63f5a72d0d21d54d76bcfe3e80d6e5481b68c
SSDEEP

6144:AkBjhJ8XjZZq4F0blqPbwykAtDMajk5nECHogdgCP6Aa:jb03FAIP/5Mek5EBUg4k

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e2dbabf16774d49dfbdf92a54f513b7

Files

0e2dbabf16774d49dfbdf92a54f513b7
.exe windows:4 windows x86 arch:x86

56f36b9f90d4caa26038cb2ef088692e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

GetMessageA
MessageBoxA

advapi32

GetSecurityDescriptorDacl

msvcrt

exit

netapi32

NetApiBufferFree

Sections

.text
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc1
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ