3e0a5db89496e8b7dae77f05836a0c39 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e0a5db89496e8b7dae77f05836a0c39
Size

3.6MB
MD5

3e0a5db89496e8b7dae77f05836a0c39
SHA1

f951de01965b5af5175976a5317a6b4021b48381
SHA256

b339875fb2e9edb4f0ade42e2725ec88006a7674a8f6a8e05b6723292d0b9bf8
SHA512

13af6dac85c81bf15cb5cb75665acb41a9fb4becaa44090919cf710887cf5ead4a4adb2665d310e2da09069573b826c468bfe139e5f01eda46c832d01b286ad1
SSDEEP

98304:6nayek5BTkpWbyciMft4vCz7lMzYrawXvzJui7cv:qbrsWLiW4vCz7sYrPX9XK

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e0a5db89496e8b7dae77f05836a0c39

Files

3e0a5db89496e8b7dae77f05836a0c39
.exe windows:4 windows x86 arch:x86

236aa52bb91371f88d5ffe859dbb4921

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_adj_fdiv_m16i

user32

MessageBoxA

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE