de4bca0bc62c8bb2b52bbbc3a0e58706f209f63a2e28a951c76eebafca5ef2b9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

de4bca0bc62c8bb2b52bbbc3a0e58706f209f63a2e28a951c76eebafca5ef2b9
Size

612KB
MD5

6f739907f950893df1c88ce14d806619
SHA1

219bcffc93fb123ee553efa591c56fe1b111b456
SHA256

de4bca0bc62c8bb2b52bbbc3a0e58706f209f63a2e28a951c76eebafca5ef2b9
SHA512

cedeec4d6554d4baa6a4f01e399f9caacfa782f913d2d863eb342ad7801fb53652143df88e6b098f993d8a3eb9d8943377f5bcb641ba003330728dcc10db6dd4
SSDEEP

12288:lu3UU+uhf7dA+QQRTA3yiqybXO0YD+tWeXjBZOWT7Yaoq7mAbgot:gx+gfxTA3XqybXmEWClUW4aorAko

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de4bca0bc62c8bb2b52bbbc3a0e58706f209f63a2e28a951c76eebafca5ef2b9

Files

de4bca0bc62c8bb2b52bbbc3a0e58706f209f63a2e28a951c76eebafca5ef2b9
.exe windows:5 windows x86 arch:x86

5ac1b838afdb92064a415901d5500938

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_adj_fpatan

kernel32

InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

CharUpperBuffW

Sections

.text
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 597KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 600KB - Virtual size: 599KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ