d3cf9e710d47c500de516645092a64c7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d3cf9e710d47c500de516645092a64c7
Size

1.1MB
MD5

d3cf9e710d47c500de516645092a64c7
SHA1

41b0f6bf4fb3696e5a961f00e462756a49273200
SHA256

ef2e208c21d7e7f799fcb8589367de50b246ee96ef1a7b2ba4a6af0f73030f1a
SHA512

a9b8b0812e91bd59817eee557bb65f611300b4863c8f65ef3283a0feb8f71d6801b8c750d2ca3e4d11e92520503cbe23d83c0e5f04023f5678034376d82abb24
SSDEEP

24576:tzQSiy10WUdsZUv0JSI/v8DVZwiCFMc5icEFmI5n05CuEjGMG6/X:5QBWUdsZqkLZd

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3cf9e710d47c500de516645092a64c7

Files

d3cf9e710d47c500de516645092a64c7
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 673KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ