f688cc1d1713585cd7b9fd1fd4e78a71 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f688cc1d1713585cd7b9fd1fd4e78a71
Size

183KB
MD5

f688cc1d1713585cd7b9fd1fd4e78a71
SHA1

2909e2fc154ac195699081f9b61dfc6ec1a0fcfe
SHA256

b67498660de800bd6419e2b80713ec658dc1bcc80a1584e71bdbdb522cb63024
SHA512

31993ee5648173c494837e3ac52b3651eddc0c39451d6c89ab0090cccdb658560594110a9e7708fbc4cd6761dd561bee8d33b96691077c463f41ecf695f00d0d
SSDEEP

3072:otBs3f0cSICsVeUh0T0eZI3jyQqozpsTQyysW9HxK4BzYUWqDzYzhMjFtIS4Zn+K:ovs3f0cSZ8neZIzJqoCpWjbYUWzhity9

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f688cc1d1713585cd7b9fd1fd4e78a71

Files

f688cc1d1713585cd7b9fd1fd4e78a71
.exe windows:4 windows x86 arch:x86

25e7d66198d9c373883b101c3f563810

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

RegisterHotKey

wininet

InternetOpenA

shlwapi

PathRemoveFileSpecA

atl

ord42

comctl32

InitCommonControlsEx

shell32

DragFinish

gdi32

DeleteDC

msvcrt

_strnicmp

Sections

.text
Size: - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE