c0748eae096974133b67236dbbfc6bc0N | Triage

Sharing

General

Target

c0748eae096974133b67236dbbfc6bc0N
Size

3.7MB
MD5

c0748eae096974133b67236dbbfc6bc0
SHA1

8180b392c4bcb418eef32d333d848b9c97dc3258
SHA256

5f88f4cccb5f3a3237e39265d2b3434664620bb85bc078bb3cadcc93ded3630c
SHA512

7258c02d7607453a9f008e2a6c097e082e0ed3fbf9d265b951b585140f58a9e0b425e77d63151543abe3ee9edafa81af0c37eb537655ddfade3cdeb752eb458a
SSDEEP

98304:jamC2MkcH7PJlIXpHKvIeFebLUZ4pv4pn2:4wKPJIpHKveLU+pv4A

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0748eae096974133b67236dbbfc6bc0N

Files

c0748eae096974133b67236dbbfc6bc0N
.exe windows:5 windows x86 arch:x86

6948d8b25c49c2574e4a4cf43c3c5889

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

LoadIconW

msvcrt

_cexit

Sections

.text
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text5
Size: - Virtual size: 68B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ