hl_27ec0000_0c841000[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

hl_27ec0000_0c841000.bin
Size

200.3MB
MD5

c126b1dd86eceb08c1db83f589820d49
SHA1

db48bc2f839afd028f9127ed5ec5a6fe6c82380f
SHA256

639dc6be964fa3539171775fbc1758cc4e8c5beacec33547b8b75203bbce49ba
SHA512

bde8ead9255fdd38a459eb3d52ef6d3972ad9e8fddff1d272e1d9c997bcfef31862fd97e869db2c10063f967434a4aa06bfc0bd847b92078039486f1c2178fd9
SSDEEP

98304:oJfzfisdLGHzQkSBPL3xu+gKON5efvw9w8RHSqkONtSMvxU2Pm1UX:ohzldLkSBPTYXKsefvhCSqkON3KS

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hl_27ec0000_0c841000.bin

Files

hl_27ec0000_0c841000.bin
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: - Virtual size: 912KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 192.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 233B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ