e205db42735a12721e171a13db1558d3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e205db42735a12721e171a13db1558d3
Size

68KB
MD5

e205db42735a12721e171a13db1558d3
SHA1

194b779a66dc7d2b4a3bcb6fc879dd42a416950d
SHA256

e2aab8f4f54457704a943d93245febed338d78b789c039115a28c7a9fc6a3b1d
SHA512

1e6bd6f5633b29314b65d7089a484d243c2501e12040f394d9e691ee6e4020a56c9f4598a79bf1d266e22343eed83154bcfce6be6a79d7f09d3fba3ce470d5a9
SSDEEP

384:tmth7181bka0GiVLKazSB1q5kw21DgTLeC8FNruBVzlbp:cT18WB5+a+BU51TLeC8FNrE1

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e205db42735a12721e171a13db1558d3

Files

e205db42735a12721e171a13db1558d3
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ