2834cccc4d5c455caa38c3a58f1db1c570cdcbde9ec15b7180d386caccddc451

General

Target
2834cccc4d5c455caa38c3a58f1db1c570cdcbde9ec15b7180d386caccddc451
Size 5.3MB
Sample240110-e6ayxadgbk
SHA256 2834cccc4d5c455caa38c3a58f1db1c570cdcbde9ec15b7180d386caccddc451
MD5 d1fda232aa3824ca95dc5ce626828ab6
SHA1 bd7c3870edc0be5a1e7220713a3471ed8968f499
SHA512 dbdc5058a9cf90b8b13a62fa9563546f4a9a99fd19552b3a79d6797f1e3b120cf355c5eecdc652578ca8468e8ae3f4a8ea86c3e3b07e8e06f20d5c78e218687a
SSDEEP 98304:nXa0EuvRni6BcySZUzqMrDbqY7RrL+eMpTK/sZRgAZp4Rvlex68YA5wLcr:Xa0Bp5cr9MLEJkiRgY4Te976
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2834cccc4d5c455caa38c3a58f1db1c570cdcbde9ec15b7180d386caccddc451

File Explorer

2834cccc4d5c455caa38c3a58f1db1c570cdcbde9ec15b7180d386caccddc451

.exe 5.3MB

2834cccc4d5c455caa38c3a58f1db1c570cdcbde9ec15b7180d386caccddc451

IMPHASH 2df728b239afe0a1df3307c216dbb0f4
SHA256 2834cccc4d5c455caa38c3a58f1db1c570cdcbde9ec15b7180d386caccddc451
MD5 d1fda232aa3824ca95dc5ce626828ab6
SHA1 bd7c3870edc0be5a1e7220713a3471ed8968f499
SHA512 dbdc5058a9cf90b8b13a62fa9563546f4a9a99fd19552b3a79d6797f1e3b120cf355c5eecdc652578ca8468e8ae3f4a8ea86c3e3b07e8e06f20d5c78e218687a
SSDEEP 98304:nXa0EuvRni6BcySZUzqMrDbqY7RrL+eMpTK/sZRgAZp4Rvlex68YA5wLcr:Xa0Bp5cr9MLEJkiRgY4Te976
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8250331

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.3MB

Virtual Size

5.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2834cccc4d5c455caa38c3a58f1db1c570cdcbde9ec15b7180d386caccddc451

kernel32

ws2_32

wtsapi32

user32

generic

Sharing

General

Malware Config

Signatures

File Explorer

2834cccc4d5c455caa38c3a58f1db1c570cdcbde9ec15b7180d386caccddc451

kernel32

ws2_32

wtsapi32

user32

generic