5695ed7fc8455878b2841782f5ca47bca2c33fdecb6df393c0ac92efbdd4302e

Sharing

Copy URL Twitter E-mail

General

Target
5695ed7fc8455878b2841782f5ca47bca2c33fdecb6df393c0ac92efbdd4302e
Size 9.9MB
Sample261030-typves1s3l
SHA256 5695ed7fc8455878b2841782f5ca47bca2c33fdecb6df393c0ac92efbdd4302e
MD5 baf82497488ff26e8cb4de98fbf0c010
SHA1 f8e04e31eb97f7bd59e0a5fb5cfb53b905b08dd5
SHA512 f4f91ba973211c77cf184b7949564756261731fb8779d1ef15998a0661e8e598153e84726ea0079352c8a17c99e41530521ff8f5e07e3df0ebbe0a8f340ccf61
SSDEEP 196608:1swSSL2iPjzmcSN+klpG3O5kscILgYoopfDhUDqJ68:1rnL9yOO5ncIRoqfDSqE
TLSH
T168A6232322614059D1D68D345837FDA5B1F50E6A8F82ECFF67963DC62A2D1E0E222F53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5695ed7fc8455878b2841782f5ca47bca2c33fdecb6df393c0ac92efbdd4302e

File Explorer

5695ed7fc8455878b2841782f5ca47bca2c33fdecb6df393c0ac92efbdd4302e

.exe 9.9MB

5695ed7fc8455878b2841782f5ca47bca2c33fdecb6df393c0ac92efbdd4302e

IMPHASH dd53543c7d30218f86421826071e91d1
SHA256 5695ed7fc8455878b2841782f5ca47bca2c33fdecb6df393c0ac92efbdd4302e
MD5 baf82497488ff26e8cb4de98fbf0c010
SHA1 f8e04e31eb97f7bd59e0a5fb5cfb53b905b08dd5
SHA512 f4f91ba973211c77cf184b7949564756261731fb8779d1ef15998a0661e8e598153e84726ea0079352c8a17c99e41530521ff8f5e07e3df0ebbe0a8f340ccf61
SSDEEP 196608:1swSSL2iPjzmcSN+klpG3O5kscILgYoopfDhUDqJ68:1rnL9yOO5ncIRoqfDSqE
TLSH
T168A6232322614059D1D68D345837FDA5B1F50E6A8F82ECFF67963DC62A2D1E0E222F53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4644304

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

170KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

24KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

5695ed7fc8455878b2841782f5ca47bca2c33fdecb6df393c0ac92efbdd4302e

ole32

oleaut32

kernel32

user32

gdi32

advapi32

shell32

ws2_32

gdiplus

wininet

wtsapi32

generic