7812fd299ceae45beb91439f791a32626dfaed04f75a0c1a68e37c86b7c7bdae | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7812fd299ceae45beb91439f791a32626dfaed04f75a0c1a68e37c86b7c7bdae
Size

5.5MB
MD5

e54a8705978717ebfdc017906a3c8396
SHA1

c77055a955b210f5b7c64e0a54c876838a77a072
SHA256

7812fd299ceae45beb91439f791a32626dfaed04f75a0c1a68e37c86b7c7bdae
SHA512

580f7e24a3f15150e8763d3ea00f892516848217c520fc18993cb960e3f6380897263aa7496b7490f98990c7770637cc0e5250aff7b7bbc9100ed845a3e8958e
SSDEEP

98304:ITD+zH0PAJ+UDJ9fKaxPIw6uM+aP3XTZIYplRPOPQGtNzGd:ITtMYaxOuMpP3X9IYp/OPQgO

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7812fd299ceae45beb91439f791a32626dfaed04f75a0c1a68e37c86b7c7bdae

Files

7812fd299ceae45beb91439f791a32626dfaed04f75a0c1a68e37c86b7c7bdae
.exe windows:6 windows x86 arch:x86

89c8abd38fd3ffc06ee06d01f9b3cbbf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

ole32

CoCreateInstance

oleaut32

SysAllocString

user32

CloseClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW

gdi32

BitBlt

wtsapi32

WTSSendMessageW

Sections

.text
Size: - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ