08095af525693ae794a4e23dda8a9723 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

08095af525693ae794a4e23dda8a9723
Size

50KB
MD5

08095af525693ae794a4e23dda8a9723
SHA1

cb6d0f70caa2c641dc470b71f89b3a69251b9314
SHA256

e7be00a565cd5e88ad21392e60c6c67fd372975b497df39352ffde9fad079a53
SHA512

94c24c61a9e4e91ab8245156d01d1fcb31688ded0ca138dd2e92d830f7ec77dc062d0291f187d9351be2411a7072d8575b2e7c918d58bc845590abb242b21813
SSDEEP

768:B7TuHxVtlBQ/K1N1UG+jZk/p0abaB7zi1aSpWOVVqsnR6llp7hCEgHPITS6S:FujG/EUG+jZ6mBy1aCCsnRKP7QESQTE

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08095af525693ae794a4e23dda8a9723

Files

08095af525693ae794a4e23dda8a9723
.exe windows:4 windows x86 arch:x86

aa82c90f9b5330c370b0f64c9ac1ccf3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrChrA

user32

PostThreadMessageA
MessageBoxA

advapi32

DeleteService

ole32

CoCreateGuid

msvcrt

__p__fmode

kernel32

SetFilePointer
GetModuleHandleA
GetProcAddress
VirtualProtect

Sections

.text
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ