0531bca84d56334c3de7a466630d5e165c5ed0982e14b4e12bba35a34b2733fd | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0531bca84d56334c3de7a466630d5e165c5ed0982e14b4e12bba35a34b2733fd
Size

855KB
MD5

571450f1e39aac009ffafce71f90abd1
SHA1

1839adb1cfd7c10d8de54ffaf388004e7550d3e1
SHA256

0531bca84d56334c3de7a466630d5e165c5ed0982e14b4e12bba35a34b2733fd
SHA512

4665c8a7f092a3220a490352717f8bb3f2f9a718714122f772e26836b661f6204bbfd81834bfb15dd7da58c8eea6b55e9a735aabeecc2b7ae878e585c5e8975a
SSDEEP

24576:3UvO+cXr3wnUeVy9/bO7dYzkB1lmGE1eY0y1fc0:3Umz74Ueo9/bOu2jW0yu0

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0531bca84d56334c3de7a466630d5e165c5ed0982e14b4e12bba35a34b2733fd

Files

0531bca84d56334c3de7a466630d5e165c5ed0982e14b4e12bba35a34b2733fd
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: - Virtual size: 416KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 789KB - Virtual size: 789KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ