f27597a1ba6802f812ca11252809ec53b585bf7e9fca8113aecc2fa5e3fb781d

Sharing

Copy URL Twitter E-mail

General

Target
f27597a1ba6802f812ca11252809ec53b585bf7e9fca8113aecc2fa5e3fb781d
Size 6.8MB
Sample260930-knj2razv5m
SHA256 f27597a1ba6802f812ca11252809ec53b585bf7e9fca8113aecc2fa5e3fb781d
MD5 c7eb1d39b922ba8734946d62ce0498c2
SHA1 b833de8228b2527d164154684b8ac162d1fd5692
SHA512 a4095542f57bb445720f403d2e64f27568edc212225846e542959ad1c22f620b046f58ba0a6223b5318a23319d0bd69b9a3b110b2021b99d8b50415d479c579a
SSDEEP 196608:xe3g50+517RbJWwNwLjfQUmL+Kv7BCyfZ:T5RRNWwWngL+Kco
TLSH
T1BF760213B64740F2C5891A304C767F7ABA7667920F21CDE7935CEDE82D232D1A632297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f27597a1ba6802f812ca11252809ec53b585bf7e9fca8113aecc2fa5e3fb781d

File Explorer

f27597a1ba6802f812ca11252809ec53b585bf7e9fca8113aecc2fa5e3fb781d

.exe 6.8MB

f27597a1ba6802f812ca11252809ec53b585bf7e9fca8113aecc2fa5e3fb781d

IMPHASH e64525760619dedf6156bdd8a61007aa
SHA256 f27597a1ba6802f812ca11252809ec53b585bf7e9fca8113aecc2fa5e3fb781d
MD5 c7eb1d39b922ba8734946d62ce0498c2
SHA1 b833de8228b2527d164154684b8ac162d1fd5692
SHA512 a4095542f57bb445720f403d2e64f27568edc212225846e542959ad1c22f620b046f58ba0a6223b5318a23319d0bd69b9a3b110b2021b99d8b50415d479c579a
SSDEEP 196608:xe3g50+517RbJWwNwLjfQUmL+Kv7BCyfZ:T5RRNWwWngL+Kco
TLSH
T1BF760213B64740F2C5891A304C767F7ABA7667920F21CDE7935CEDE82D232D1A632297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4551531

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

643KB

Virtual Size

644KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

92KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

23KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.maopo

Size

984KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_MEM_EXECUTE

Name

.vmp1

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp2

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

f27597a1ba6802f812ca11252809ec53b585bf7e9fca8113aecc2fa5e3fb781d

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

wtsapi32

generic