a09dcec94458d1970ded54ec374167cd227fea6ff4b56effa1755926d7bd5f41

Sharing

Copy URL Twitter E-mail

General

Target
a09dcec94458d1970ded54ec374167cd227fea6ff4b56effa1755926d7bd5f41
Size 6.8MB
Sample240410-p896wsbf91
SHA256 a09dcec94458d1970ded54ec374167cd227fea6ff4b56effa1755926d7bd5f41
MD5 d088405edcf61c7fb54b260bc6315a31
SHA1 997f482fcca4cc5704bb0bf8b47132dd34aa0a37
SHA512 1bc794a0c84525d67b8a3aecdd4544942cced8996f0b04fa8da1649a14fdd746638ba87b850c3046a3e82c1a455c2168802fe85b45b86436ca2515885e7bb86c
SSDEEP 98304:q7WKfdq7RyQdh/ha7TTOzAElMLmZ7oo8kTApKGaRqc4O1XujlqScYEYrsG3AH:qCUdcRwfTTLmxoQT7RRq4ujltcYN9w
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a09dcec94458d1970ded54ec374167cd227fea6ff4b56effa1755926d7bd5f41

File Explorer

a09dcec94458d1970ded54ec374167cd227fea6ff4b56effa1755926d7bd5f41

.exe 6.8MB

a09dcec94458d1970ded54ec374167cd227fea6ff4b56effa1755926d7bd5f41

IMPHASH 79cd79a053312805e385709916670c17
SHA256 a09dcec94458d1970ded54ec374167cd227fea6ff4b56effa1755926d7bd5f41
MD5 d088405edcf61c7fb54b260bc6315a31
SHA1 997f482fcca4cc5704bb0bf8b47132dd34aa0a37
SHA512 1bc794a0c84525d67b8a3aecdd4544942cced8996f0b04fa8da1649a14fdd746638ba87b850c3046a3e82c1a455c2168802fe85b45b86436ca2515885e7bb86c
SSDEEP 98304:q7WKfdq7RyQdh/ha7TTOzAElMLmZ7oo8kTApKGaRqc4O1XujlqScYEYrsG3AH:qCUdcRwfTTLmxoQT7RRq4ujltcYN9w
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9438191

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

Virtual Size

725KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

464KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.symtab

Size

Virtual Size

134KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.vmp1

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

6.7MB

Virtual Size

6.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

a09dcec94458d1970ded54ec374167cd227fea6ff4b56effa1755926d7bd5f41

kernel32

user32

generic