7b155120d7d1a3b1aae6955d39624829

General

Target
7b155120d7d1a3b1aae6955d39624829
Size 4.6MB
Sample240127-x7eycsccdn
SHA256 ecc186eda569c87982148c44607d42667c2b63f011433c7ddcf54c0657376d13
MD5 7b155120d7d1a3b1aae6955d39624829
SHA1 d54809723ac65f464caeaaf4a0dd95ad3f0573e7
SHA512 46da85d53e74165292ca5678cc7111a30ce8a1168d17c1226a27c3e630ffb06fcf312ad05f8ef6e5b685a5601db17a4e2aefc4444ef8482977d0e749c885ce7c
SSDEEP 98304:fC+fH4oMx43UFYbEsSuVPndcQeIZsu2E9lhoNMDzgj:JfHLYB7sjVPbeMxJv2NMD+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b155120d7d1a3b1aae6955d39624829

File Explorer

7b155120d7d1a3b1aae6955d39624829

.exe 4.6MB

7b155120d7d1a3b1aae6955d39624829

IMPHASH 09690d629cfc9372ddd39f1391531d9f
SHA256 ecc186eda569c87982148c44607d42667c2b63f011433c7ddcf54c0657376d13
MD5 7b155120d7d1a3b1aae6955d39624829
SHA1 d54809723ac65f464caeaaf4a0dd95ad3f0573e7
SHA512 46da85d53e74165292ca5678cc7111a30ce8a1168d17c1226a27c3e630ffb06fcf312ad05f8ef6e5b685a5601db17a4e2aefc4444ef8482977d0e749c885ce7c
SSDEEP 98304:fC+fH4oMx43UFYbEsSuVPndcQeIZsu2E9lhoNMDzgj:JfHLYB7sjVPbeMxJv2NMD+
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11579081

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

459KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

7b155120d7d1a3b1aae6955d39624829

advapi32

kernel32

user32

shell32

winhttp

userenv

rpcrt4

psapi

wtsapi32

generic

Sharing

General

Malware Config

Signatures

File Explorer

7b155120d7d1a3b1aae6955d39624829

advapi32

kernel32

user32

shell32

winhttp

userenv

rpcrt4

psapi

wtsapi32

generic