d72dc7cd7424054464e20236a3624ab8 | Triage

Sharing

General

Target

d72dc7cd7424054464e20236a3624ab8
Size

627KB
MD5

d72dc7cd7424054464e20236a3624ab8
SHA1

d6fe2c20aa943e0ff736e24ef5aaa72475eecf17
SHA256

e4a43a4bb2fc03c39ea15f3fd5415add00671eb8b3bafec450336a57c3be6dc7
SHA512

761599bbff14b112919abc543ab2535812070392212492ba58d2335749fc518690684a4bfe70b895008bc49aa46ba11831fbfc41bd1b20e60c3f25145e66dd02
SSDEEP

1536:9wUaBcJI5juX1hXYv33IebvEdMuU7IYNMWzE5szXzLHGm7+Gig8:WTBGHlhov3XjGxu1NMKzXnR+Gk

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d72dc7cd7424054464e20236a3624ab8

Files

d72dc7cd7424054464e20236a3624ab8
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 546KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 626KB - Virtual size: 625KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ