aa51573f9abcd4a1ec4a61ee7e5811c0279e015ea22bdb787780d67ce7153a57[.]exe

General

Target
aa51573f9abcd4a1ec4a61ee7e5811c0279e015ea22bdb787780d67ce7153a57.exe
Size 1.1MB
Sample260317-prvd4sa18m
SHA256 aa51573f9abcd4a1ec4a61ee7e5811c0279e015ea22bdb787780d67ce7153a57
MD5 61f65bd593ea0e52ac0dfdc6bc9cd73a
SHA1 e5adeecfb03cc7d26de2f11746d3aef6b1fd4830
SHA512 8d1e787c9313f26c8f2925572e2e88191529f6b3f69c5a4f8db301d6a263ad4346b4d1e0a8710fc9fa491e627a872a6627b56177c1f1f930ace8cb9fc837ced1
SSDEEP 24576:PUotovoXGo9zmmtVjRXEhMWgh5RfSqR8kkR2J9IWB7IyLS5LNYwihU:lmo2ixH++Wg51SqGkkR2bWyW5pY/h
TLSH
T15C4533AC0388E071CC079F7BACAE6B296D6C2535A3E9DDABD3C724217A574538C351D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa51573f9abcd4a1ec4a61ee7e5811c0279e015ea22bdb787780d67ce7153a57.exe

File Explorer

aa51573f9abcd4a1ec4a61ee7e5811c0279e015ea22bdb787780d67ce7153a57.exe

.exe 1.1MB

aa51573f9abcd4a1ec4a61ee7e5811c0279e015ea22bdb787780d67ce7153a57.exe

IMPHASH 0efd6cb0c6e770fe9c94ebe37a1fcc56
SHA256 aa51573f9abcd4a1ec4a61ee7e5811c0279e015ea22bdb787780d67ce7153a57
MD5 61f65bd593ea0e52ac0dfdc6bc9cd73a
SHA1 e5adeecfb03cc7d26de2f11746d3aef6b1fd4830
SHA512 8d1e787c9313f26c8f2925572e2e88191529f6b3f69c5a4f8db301d6a263ad4346b4d1e0a8710fc9fa491e627a872a6627b56177c1f1f930ace8cb9fc837ced1
SSDEEP 24576:PUotovoXGo9zmmtVjRXEhMWgh5RfSqR8kkR2J9IWB7IyLS5LNYwihU:lmo2ixH++Wg51SqGkkR2bWyW5pY/h
TLSH
T15C4533AC0388E071CC079F7BACAE6B296D6C2535A3E9DDABD3C724217A574538C351D8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2244758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

1016KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

aa51573f9abcd4a1ec4a61ee7e5811c0279e015ea22bdb787780d67ce7153a57.exe

kernel32

shell32

ole32

user32

generic

Sharing

General

Malware Config

Signatures

File Explorer

aa51573f9abcd4a1ec4a61ee7e5811c0279e015ea22bdb787780d67ce7153a57.exe

kernel32

shell32

ole32

user32

generic