7fb3bf47e56c9836e0edfeddfe8359ce

General

Target
7fb3bf47e56c9836e0edfeddfe8359ce
Size 62KB
Sample240129-ncsfjagec5
SHA256 d48242196bb02d73674392ca398fad4714c34ce9852e53ce138f1297d003ba97
MD5 7fb3bf47e56c9836e0edfeddfe8359ce
SHA1 4ada8d8aa4006b8dd98d174ca8d469c5810a169b
SHA512 63529a6cbb7558e2987bfd52cd5c01bd83e6d4bdf2491e3f769e1fe6de1683a8a00529e5e5754e9a214b67e13babdfc7b18839ab157f842177d1610fb4f79c5c
SSDEEP 1536:HiBvcUtfcX5fS25VmOZG6V0d3oqaQpFOaC:CFtEX5XZG6mlxfpg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7fb3bf47e56c9836e0edfeddfe8359ce

File Explorer

7fb3bf47e56c9836e0edfeddfe8359ce

.sys 62KB

7fb3bf47e56c9836e0edfeddfe8359ce

IMPHASH 4d61433b1363177baf5ae6962c463e46
SHA256 d48242196bb02d73674392ca398fad4714c34ce9852e53ce138f1297d003ba97
MD5 7fb3bf47e56c9836e0edfeddfe8359ce
SHA1 4ada8d8aa4006b8dd98d174ca8d469c5810a169b
SHA512 63529a6cbb7558e2987bfd52cd5c01bd83e6d4bdf2491e3f769e1fe6de1683a8a00529e5e5754e9a214b67e13babdfc7b18839ab157f842177d1610fb4f79c5c
SSDEEP 1536:HiBvcUtfcX5fS25VmOZG6V0d3oqaQpFOaC:CFtEX5XZG6mlxfpg
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4172

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

1024B

Virtual Size

772B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

7fb3bf47e56c9836e0edfeddfe8359ce

ntoskrnl.exe

generic

Sharing

General

Malware Config

Signatures

File Explorer

7fb3bf47e56c9836e0edfeddfe8359ce

ntoskrnl.exe

generic