5559372b6a3ff4a0fd539ddaa0463280 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5559372b6a3ff4a0fd539ddaa0463280
Size

634KB
MD5

5559372b6a3ff4a0fd539ddaa0463280
SHA1

27ab9fd5b3bbc3a66df85775c16ec477cf0b1479
SHA256

0bd9f4d54625817c5fff2713c110aa872b036840d3f70eb5a6364bbec99d2c6b
SHA512

baeecda43db0cb4976d6ea2fba1d226046ed952e0e16648c4094771fe18528d3f9a49c357bb6cb3eea2971d867779f27724f5f76c445a1955a90e14fa9a2bf8d
SSDEEP

6144:DjaljFIgmk7eJ/+Su0qevFsZ+8jKaDbptT0HjWLNLf0VyLNLf0VqiYEcwxAU0Ng7:PRgmIekSu0TsZ+8jjptQDptqccwP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5559372b6a3ff4a0fd539ddaa0463280

Files

5559372b6a3ff4a0fd539ddaa0463280
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 321KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 233KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 528KB - Virtual size: 527KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ