7e59d129868fbff6211acc407f90411b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7e59d129868fbff6211acc407f90411b
Size

2.8MB
MD5

7e59d129868fbff6211acc407f90411b
SHA1

6f93999e51820f9bdce745746d86287070477fa1
SHA256

637073e058e77a55d4490343469f200183c3b9b8c72fc372a732b0c3be1568a4
SHA512

8959dc6a8724ccc01b0b15bf09370bdcc40dff69d415a3f5f9595463e7674557ef77fcbc5c8b6c256129cde1c3d6195d0ec995026aaa5a4336b8f920b5ea1d26
SSDEEP

49152:SoAH+MdcrCRLS72awxKRpRE8VrtqRBM0+JlRRJ42ce0HHjSyjkD8clQZiRO57D:SoLTrC5S72axpREZRBMbRJ4xemDSyoon

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e59d129868fbff6211acc407f90411b

Files

7e59d129868fbff6211acc407f90411b
.exe windows:4 windows x86 arch:x86

f332f9523608b1f79f8620a3be742d28

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_adj_fdivr_m32i

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Sections

.text
Size: - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 935KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE