10cf86513622c507f38c5a3baa4f1a99bc4545c65f987c171e46f650d2a12712

Sharing

Copy URL Twitter E-mail

General

Target
10cf86513622c507f38c5a3baa4f1a99bc4545c65f987c171e46f650d2a12712
Size 10.3MB
Sample260710-g4c2laew4n
SHA256 10cf86513622c507f38c5a3baa4f1a99bc4545c65f987c171e46f650d2a12712
MD5 1f6d0cd872d8751583b5464bd15a05a7
SHA1 87808d10f78897542d5589b8878758378f80d8c8
SHA512 10d72cf98cce32b4bfed404b39788003f45a94bbbead3fd7c3c112af55ce01736911fe130f40513c58369f1ca265fd5e874cdf9966aefb9626c0feb98218330f
SSDEEP 196608:j1X3JFogPGH+UJGI/ifdyCifquGgnnjqezGUKe3nNeR4imJnfst0:1JmtcIafMrfquGgnjqeSUfnNeijst0
TLSH
T179B633339264018AE4D984399E3BBDF632F20BE6CF41EC7D65EEB9C615364B0D642583
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10cf86513622c507f38c5a3baa4f1a99bc4545c65f987c171e46f650d2a12712

File Explorer

10cf86513622c507f38c5a3baa4f1a99bc4545c65f987c171e46f650d2a12712

.exe 10.3MB

10cf86513622c507f38c5a3baa4f1a99bc4545c65f987c171e46f650d2a12712

IMPHASH 83b1d500f3c34667bb68e370fafebb3c
SHA256 10cf86513622c507f38c5a3baa4f1a99bc4545c65f987c171e46f650d2a12712
MD5 1f6d0cd872d8751583b5464bd15a05a7
SHA1 87808d10f78897542d5589b8878758378f80d8c8
SHA512 10d72cf98cce32b4bfed404b39788003f45a94bbbead3fd7c3c112af55ce01736911fe130f40513c58369f1ca265fd5e874cdf9966aefb9626c0feb98218330f
SSDEEP 196608:j1X3JFogPGH+UJGI/ifdyCifquGgnnjqezGUKe3nNeR4imJnfst0:1JmtcIafMrfquGgnjqeSUfnNeijst0
TLSH
T179B633339264018AE4D984399E3BBDF632F20BE6CF41EC7D65EEB9C615364B0D642583
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13657412

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sedata

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sedata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp1

Size

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp2

Size

10.2MB

Virtual Size

10.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

56KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

10cf86513622c507f38c5a3baa4f1a99bc4545c65f987c171e46f650d2a12712

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

msvcrt

iphlpapi

psapi

wtsapi32

generic