174825a6d23ca4dc0010214baa49de9f0383e6461469c377499b9152549efb25 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

174825a6d23ca4dc0010214baa49de9f0383e6461469c377499b9152549efb25
Size

474KB
MD5

48ea1bd1572d670b8b94f63a269b3062
SHA1

e1c146857813f0d60b64e8a0c18f9ade2ef09a69
SHA256

174825a6d23ca4dc0010214baa49de9f0383e6461469c377499b9152549efb25
SHA512

1f9d0a2e3fcdb8529ca0ecd46e493be47b4709474936b1201697faa18a0855119d3f47f85bcaeb1e7e6fd5287cbd2d546b9f5ea65ade1aa5b96fdb59f60ef05f
SSDEEP

12288:BoAGirgHEePhLlLvK8f8NknTG0t652/xEpq5q:BuHbLluw5WBpq4

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
174825a6d23ca4dc0010214baa49de9f0383e6461469c377499b9152549efb25

Files

174825a6d23ca4dc0010214baa49de9f0383e6461469c377499b9152549efb25
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 498KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ