23c0c3cba5d182b1530f1b4348650036 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

23c0c3cba5d182b1530f1b4348650036
Size

14.9MB
MD5

23c0c3cba5d182b1530f1b4348650036
SHA1

7954ae39fff8d0d9884d96cfd02a2affc23e0cf3
SHA256

f5451f097ba6f218d184e5373444bc44210cbb87a4c7b0bec967e18dfb953ca4
SHA512

bd5bba64f9e017b8bd74d300f495c673dfaea874edaec4442475df37a9ec9a347e1ceab85c0ecec73d55a5a9cc05cb91d1d426624d6ecb7b4ac56d874110b930
SSDEEP

393216:TPdptHfukQOj++M8rbZrqokX4xnw0mFiaHo++qlFwV:TBHfukCiVVkX4u0mFfHo+jFwV

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23c0c3cba5d182b1530f1b4348650036

Files

23c0c3cba5d182b1530f1b4348650036
.exe windows:5 windows x86 arch:x86

1905cfc1b8e0c8c0fcfc6331f0cf060a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindFileNameA

kernel32

LockResource
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

CreateWindowExA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 12.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 14.9MB - Virtual size: 14.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ