940696463e31255862ba0178126574fe9799682c8318de73da88371be760185b

General

Target
940696463e31255862ba0178126574fe9799682c8318de73da88371be760185b
Size 6.6MB
Sample260529-gghcssdt4k
SHA256 940696463e31255862ba0178126574fe9799682c8318de73da88371be760185b
MD5 2a32bbdeb884d603224dc3d6ebc4f2ff
SHA1 0b482b1a972652b1dbe2004999e0220971324eae
SHA512 6d6667c63a1a1d487c9810fb0c2018edd04a1012daeace7ac51206c384198e2fff21cc8344f33fc6a0b663084490661db63c34d3b2fb578606327a28f612f532
SSDEEP 196608:7d+stfIzyhh6MvzVQuytJVrzdN8WWiQN6vcG/xRejTJ:RJfIzyhh6MvzVQuytbzdIJN60OP
TLSH
T154661241FBE2C1F2D56795315876FB3EDA31DD124F148AA7B7A0FB984C326E06922206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
940696463e31255862ba0178126574fe9799682c8318de73da88371be760185b

File Explorer

940696463e31255862ba0178126574fe9799682c8318de73da88371be760185b

.exe 6.6MB

940696463e31255862ba0178126574fe9799682c8318de73da88371be760185b

IMPHASH 4ff64f2c16a303f9940ae3026d5b4b2c
SHA256 940696463e31255862ba0178126574fe9799682c8318de73da88371be760185b
MD5 2a32bbdeb884d603224dc3d6ebc4f2ff
SHA1 0b482b1a972652b1dbe2004999e0220971324eae
SHA512 6d6667c63a1a1d487c9810fb0c2018edd04a1012daeace7ac51206c384198e2fff21cc8344f33fc6a0b663084490661db63c34d3b2fb578606327a28f612f532
SSDEEP 196608:7d+stfIzyhh6MvzVQuytJVrzdN8WWiQN6vcG/xRejTJ:RJfIzyhh6MvzVQuytbzdIJN60OP
TLSH
T154661241FBE2C1F2D56795315876FB3EDA31DD124F148AA7B7A0FB984C326E06922206
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5403430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

718KB

Virtual Size

720KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

77KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

940696463e31255862ba0178126574fe9799682c8318de73da88371be760185b

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

generic

Sharing

General

Malware Config

Signatures

File Explorer

940696463e31255862ba0178126574fe9799682c8318de73da88371be760185b

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

generic