4f7460be122037a65f6c4c3c13a00544 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4f7460be122037a65f6c4c3c13a00544
Size

172KB
MD5

4f7460be122037a65f6c4c3c13a00544
SHA1

a87b9dbe802cecf753614be356c1d251221f6cce
SHA256

dc479c343ba03f6257dcd1b3741c1d9d55d2b0f860e60397ea85f4a0a7ee66f7
SHA512

ad72dfc9d60060d7714250b3bc6aacb333b64f36b80afce9490f633ed82288444d64c47682f2a8bd56b0959f6ce7a480db1fb3d7c6afaff56d22a59effe2ea94
SSDEEP

3072:wmKWjaP69RYyMzX/eV6a+oKFOP6btTrUWtZBqfXFu:3haYc7W0aGw6b5rUAZBo8

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f7460be122037a65f6c4c3c13a00544

Files

4f7460be122037a65f6c4c3c13a00544
.exe windows:4 windows x86 arch:x86

7f2be5189a3856fa9e82d54bee10ed07

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RaiseException
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

advapi32

GetTokenInformation

ole32

CoCreateInstance

oleaut32

VariantClear

psapi

EnumProcessModules

Sections

.text
Size: - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 168KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE