8093f74043b2336a96cb03d77665736a

General

Target
8093f74043b2336a96cb03d77665736a
Size 152KB
Sample240129-xbf6jshgem
SHA256 26ca66abd951b12fcb0f69fa151b499ec27e8543ebf1735d37b6d6cbfcd1f57f
MD5 8093f74043b2336a96cb03d77665736a
SHA1 8aeb3935842de190807f9216f50f202266ccc310
SHA512 b9ac01d3fc76a41fcb23e21bb50004cc72a375b6f77bfa0daec8168adcd68eb3132fc6156d01cb5456b5ad9f2f0d6387462ee5ae434ecee1ae61aaea6e33c88c
SSDEEP 3072:FtiMLZyPEYL+QL5kWG3QWTtXC/TOoICf1XsscClwvA6s:FIeZavLRG3BXyRJXTh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8093f74043b2336a96cb03d77665736a

File Explorer

8093f74043b2336a96cb03d77665736a

.dll 152KB

8093f74043b2336a96cb03d77665736a

IMPHASH 7f6686a4a8baf119cf52d9b2dc426957
SHA256 26ca66abd951b12fcb0f69fa151b499ec27e8543ebf1735d37b6d6cbfcd1f57f
MD5 8093f74043b2336a96cb03d77665736a
SHA1 8aeb3935842de190807f9216f50f202266ccc310
SHA512 b9ac01d3fc76a41fcb23e21bb50004cc72a375b6f77bfa0daec8168adcd68eb3132fc6156d01cb5456b5ad9f2f0d6387462ee5ae434ecee1ae61aaea6e33c88c
SSDEEP 3072:FtiMLZyPEYL+QL5kWG3QWTtXC/TOoICf1XsscClwvA6s:FIeZavLRG3BXyRJXTh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

376344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

144KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

8093f74043b2336a96cb03d77665736a

kernel32

user32

advapi32

generic

Sharing

General

Malware Config

Signatures

File Explorer

8093f74043b2336a96cb03d77665736a

kernel32

user32

advapi32

generic