241d89af51c35c19dbae85bd8352b786 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

241d89af51c35c19dbae85bd8352b786
Size

42KB
MD5

241d89af51c35c19dbae85bd8352b786
SHA1

4c96ca97fd19695769f5694babde8487af2378ac
SHA256

0649dd91aa0007edfdae85290e44548bb1460c95c85aaea8a51cc3a3075dcccb
SHA512

d8f94afa100b6aaf563a6f66e8de320beb1aaf1d5c2673503ee7f9e1276de62bfe10996d50b1953524dbd235c0f94787de6e192104507e0ea69c39bcaab865ba
SSDEEP

768:vHPO2m9WSxRFBL+8d8jL7K80KjP1Fm0T5TvUhwTK+EDW:v2Lo0RFBLJu7KvCqCghnD

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
241d89af51c35c19dbae85bd8352b786

Files

241d89af51c35c19dbae85bd8352b786
.exe windows:3 windows x86 arch:x86

5f7c1c5f782810323dacf24bcb0e83db

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
ExitProcess

Sections

.idata
Size: - Virtual size: 326B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: - Virtual size: 22KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ