0e1b11e24885a7aa54b525bcab039f10N[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e1b11e24885a7aa54b525bcab039f10N.exe
Size

164KB
MD5

0e1b11e24885a7aa54b525bcab039f10
SHA1

8d92137207326b15e8dfc7c08d6a2d2c04fdbd3c
SHA256

1ba6e429457ceb9944b5baf20bfaff0dd75e7d6afb1a1c6f8766d703ae0822d1
SHA512

a5b9144e49a6c1062564755dfbaae2256164179732854f4c6bff30b54aca49a05a433471774819b46d5975468f9ecf1d055425dffc87f06ebd92f90a78a18f89
SSDEEP

3072:F5xX/sqvJvFM5DxUxw07rKe4Gm2EiR3lDVKuAFvOsI8Nxae0:RX/RvM5Y74GZEiR3lhJAFrQe0

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e1b11e24885a7aa54b525bcab039f10N.exe

Files

0e1b11e24885a7aa54b525bcab039f10N.exe
.dll windows:4 windows x86 arch:x86

f7383534a59a4faf8ad86ac9ac3bfc8a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

ScreenToClient

gdi32

GetPixel

Sections

.text
Size: - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 354KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ