b4109d92fb83524c17ac1a71ab2f4d899cf924ac67c305b965ba9b0615ec2495N | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b4109d92fb83524c17ac1a71ab2f4d899cf924ac67c305b965ba9b0615ec2495N
Size

3.6MB
MD5

c74b527fb32db521a08d83066958f6e0
SHA1

da87488f854acd7b293654fea0cc4c5cc98133be
SHA256

b4109d92fb83524c17ac1a71ab2f4d899cf924ac67c305b965ba9b0615ec2495
SHA512

c294ad4418213372f900028518e60e775631143cbc43e152053883a7131b0c9b7a880b67921824406dc534a483383a2575229bb11acdef5975e6ab61ceb7119f
SSDEEP

98304:56k6vUvxc8KUy5CftSc2Wv07jdKMXlzeZ3/yTYp:5uIxPy5CV3ydxXlzeZPgY

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4109d92fb83524c17ac1a71ab2f4d899cf924ac67c305b965ba9b0615ec2495N

Files

b4109d92fb83524c17ac1a71ab2f4d899cf924ac67c305b965ba9b0615ec2495N
.exe windows:5 windows x86 arch:x86

c4b7d38e170cc158221d53b2656004b6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarVargNofree

kernel32

InterlockedDecrement
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

MessageBoxW

Sections

.text
Size: - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ