9afee98f2c8c4d153bd366d04d8c6442 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9afee98f2c8c4d153bd366d04d8c6442
Size

76KB
MD5

9afee98f2c8c4d153bd366d04d8c6442
SHA1

1f5dec4eaec2ffbec593c545947225088f5aeb80
SHA256

31b725b5a2996ee11ccbe794fd067683afa30e4e446561464719354848eb671f
SHA512

903d0c27d91e223489176733161120f5aeeb2f1d83384c374a9209f20355c016901aa07319efb445023a86af141962cf249ab9aff2d16f5f670e7d8717baabfe
SSDEEP

1536:jPKCMR5xxUlmtSMOiStRrLw3opw3wEXui6Mhm2OWmLrVb:jPKCEYmtSMtwrLwYpw3N+ivhI3

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9afee98f2c8c4d153bd366d04d8c6442

Files

9afee98f2c8c4d153bd366d04d8c6442
.exe windows:4 windows x86 arch:x86

a4c77d8c3c9fdec8db00557be1d47f64

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

wsprintfA

msvcrt

srand

Sections

.text
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.vmp1
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE