VMProtect Professional v3.10.1 Build 2465.zip
- SHA256 463aa46ad64d8b6e556a13703b2c43aba56714aee764b06c9c7dfc7c805b7482
Overview
overview
8Static
static
5VMProtect ...DK.dll
windows10-2004-x64
1VMProtect ...DK.dll
windows11-ltsc_2024-x64
1VMProtect ...ct.dll
windows10-2004-x64
1VMProtect ...ct.dll
windows11-ltsc_2024-x64
8VMProtect ...64.dll
windows10-2004-x64
1VMProtect ...64.dll
windows11-ltsc_2024-x64
1VMProtect ...32.dll
windows10-2004-x64
3VMProtect ...32.dll
windows11-ltsc_2024-x64
8VMProtect ...64.dll
windows10-2004-x64
1VMProtect ...64.dll
windows11-ltsc_2024-x64
1VMProtect ...32.dll
windows10-2004-x64
3VMProtect ...32.dll
windows11-ltsc_2024-x64
8VMProtect ...64.dll
windows10-2004-x64
1VMProtect ...64.dll
windows11-ltsc_2024-x64
1VMProtect ...ct.exe
windows10-2004-x64
1VMProtect ...ct.exe
windows11-ltsc_2024-x64
8VMProtect ...on.exe
windows10-2004-x64
5VMProtect ...on.exe
windows11-ltsc_2024-x64
5Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Net/VMProtect.SDK.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Net/VMProtect.SDK.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral3
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtect.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtect.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral5
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectARM64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectARM64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral7
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK32.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral8
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK32.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral9
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK32.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral12
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK32.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
900 seconds
Behavioral task
behavioral13
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
VMProtect Professional v3.10.1 Build 2465/VMProtect.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral16
Sample
VMProtect Professional v3.10.1 Build 2465/VMProtect.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral17
Sample
VMProtect Professional v3.10.1 Build 2465/VMProtect_Con.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral18
Sample
VMProtect Professional v3.10.1 Build 2465/VMProtect_Con.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
General
- Target VMProtect Professional v3.10.1 Build 2465.zip
- Size 68.0MB
- Sample261102-hljbbstv2r
- SHA256 463aa46ad64d8b6e556a13703b2c43aba56714aee764b06c9c7dfc7c805b7482
- MD5 587ce77047fbfff0188402f387c71ada
- SHA1 3b4abe453f9ab5cdd348677771db4b707cf8c72a
- SHA512 c5fd736e4ab8b06477cc98fccb2fb81d207f810bdb9fbe1a2e9421389cf7dfc2cfc8a2ebe465263f0c9b406350fecec18c590e9aed4df5cbf0f8492e1e5325ff
- SSDEEP 1572864:SjcrVrM9UIGfibEoEz9dPaZrnW5eONy3P6uEGWTEmHpdZNWfkAeWeU/AE+:SYrm946bEp7aZrQ54/pEXTEYC5lAE+
- TLSH T11FF7330BCF924F24E85F1735BFACA307BFD815EC5521A936B69E6DC826F174640D82A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 2 IoCs
File was altered after it was signed.
resource unpack001/VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtect.dll unpack001/VMProtect Professional v3.10.1 Build 2465/VMProtect.exe - Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/VMProtect Professional v3.10.1 Build 2465/VMProtect_Con.exe - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/VMProtect Professional v3.10.1 Build 2465/Lib/Net/VMProtect.SDK.dll unpack001/VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK32.sys unpack001/VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK64.sys unpack001/VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK32.dll unpack001/VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK64.dll
File Explorer
-
VMProtect Professional v3.10.1 Build 2465.zip.zip 68.0MB
-
VMProtect Professional v3.10.1 Build 2465/Include/ASM/VMProtectSDK.inc2KB
-
VMProtect Professional v3.10.1 Build 2465/Include/C/VMProtectDDK.h3KB
-
VMProtect Professional v3.10.1 Build 2465/Include/C/VMProtectSDK.h3KB
-
VMProtect Professional v3.10.1 Build 2465/Include/Go/VMProtectSDK.h3KB
-
VMProtect Professional v3.10.1 Build 2465/Include/Go/vmprotect.go2KB
-
VMProtect Professional v3.10.1 Build 2465/Include/Pascal/VMProtectSDK.pas9KB
-
VMProtect Professional v3.10.1 Build 2465/Include/VB6/VMProtectSDK.bas3KB
-
VMProtect Professional v3.10.1 Build 2465/Langs/de.lng10KB
-
VMProtect Professional v3.10.1 Build 2465/Langs/en.lng10KB
-
VMProtect Professional v3.10.1 Build 2465/Langs/fr.lng11KB
-
VMProtect Professional v3.10.1 Build 2465/Langs/ru.lng21KB
-
VMProtect Professional v3.10.1 Build 2465/Langs/zh.lng12KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Linux/libVMProtectARM64.so.elf 19KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Linux/libVMProtectSDK32.so.elf 16KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Linux/libVMProtectSDK64.so.elf 18KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Net/VMProtect.SDK.dll.dll 10KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/BCC64ELF/VMProtectSDK64.lib2KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/MinGW/VMProtectSDK32.a18KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/MinGW/VMProtectSDK64.a18KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/OMF/VMProtectSDK32.lib3KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtect.dll.dll 89.7MB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectARM64.dll113KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectARM64.lib7KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK32.lib7KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK32.sys.dll 3KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK64.lib7KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK64.sys.dll 2KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK32.dll.dll 98KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK32.lib7KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK64.dll.dll 115KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK64.lib7KB
-
VMProtect Professional v3.10.1 Build 2465/Lib/macOS/libVMProtectSDK.dylib.dylib 102KB
-
VMProtect Professional v3.10.1 Build 2465/VMProtect.exe.exe 34.4MB
-
VMProtect Professional v3.10.1 Build 2465/VMProtect_Con.exe.exe 23.9MB
VMProtect Professional v3.10.1 Build 2465/Include/ASM/VMProtectSDK.inc
- SHA256 9d41f7bf8f220e721e34f54665db9b63caca9ea00fc650f81492736a196f731e
- MD5 a8c48a4a96b59b8bb464223cc5a7c66f
- SHA1 19c91906b42228e7c03c872fc3e2ceca2ed73658
- SHA512 121b00dbc539a9597235e7b44eb7aeb773daaa06e19cf48a44aa0ff935dba2e5cd1de5ac7585696744a9ea06918e775f649fbed32c01fa862d4cb112fe08dffe
- TLSH T1B44112068509768FC0A345B6BAA5AC50BE9BF91113FCCA6B60E50803134752CE7BDF9B
- MD5 SHA1 SHA512 TLSH
VMProtect Professional v3.10.1 Build 2465/Include/C/VMProtectDDK.h
- SHA256 e98615fe5506da30061c63a3c6a3b1dfd23892f783d1aa6a9e4fe891a59f2283
- MD5 28f7681c7317ba191dcc8bf36a6f6455
- SHA1 917c2fadc5e6ce96d52d0a2ca20e5436ec83d90f
- SHA512 6fea13ca6a2c55817ca968cec02df016b9d66f99f1dea71734d9de02170aa1817e7ac69f631810d5af25eccab298e4df89f5a2e59ec9ffda16247615c08bd41f
- TLSH T15561BD410D01306ED192D7F56737DC6225ACF12335F6EDEB220A24151BC354DABAEAAF
- MD5 SHA1 SHA512 TLSH
VMProtect Professional v3.10.1 Build 2465/Include/C/VMProtectSDK.h
- SHA256 2300b7b4bb6bbf9cfa08013ec2d9b2fdceb3dfd2e603cd1e24a493de4d165b15
- MD5 e8c78f60aaad4671110eba8991fe94ef
- SHA1 dce765aa7929102ad95dfac47325c67bc668c409
- SHA512 0b4d8366a75222834d6bf0ef1f403a15a6092312005683676f77c57fed370f109516354969c458a5c6d5dd32c3d0ad7d46ea7c70650e5f0b1eb3903231eed4be
- TLSH T1C571AB010D0120AEE292D7A52B77DD52359CF12335F6E8EF220A64151AC354E6BEEA9F
- MD5 SHA1 SHA512 TLSH
VMProtect Professional v3.10.1 Build 2465/Include/Go/VMProtectSDK.h
- SHA256 2300b7b4bb6bbf9cfa08013ec2d9b2fdceb3dfd2e603cd1e24a493de4d165b15
- MD5 e8c78f60aaad4671110eba8991fe94ef
- SHA1 dce765aa7929102ad95dfac47325c67bc668c409
- SHA512 0b4d8366a75222834d6bf0ef1f403a15a6092312005683676f77c57fed370f109516354969c458a5c6d5dd32c3d0ad7d46ea7c70650e5f0b1eb3903231eed4be
- TLSH T1C571AB010D0120AEE292D7A52B77DD52359CF12335F6E8EF220A64151AC354E6BEEA9F
- MD5 SHA1 SHA512 TLSH
VMProtect Professional v3.10.1 Build 2465/Include/Go/vmprotect.go
- SHA256 b5bc56cfb0a1a9d14773c688f191a744a8df82571f857bafff3ed534dc9185ee
- MD5 7466ecfb21aa217fdea7bca78eb8dd96
- SHA1 0ee1a95058559da83e015415924f5bb788a3cbd0
- SHA512 561afece7a5ad346046ad23dd477fc72762a0e5e1eadc902d4d656788c1fd30ac004db9da3dfef2ad1e9bcbaa7093a19fbfb1689040e4bd63d9811947335feb8
- TLSH T1B55114422693A10ED1D213552635F9907CC6F12256F7C1ABB1CC42E5B3AA1587B3C67A
- MD5 SHA1 SHA512 TLSH
VMProtect Professional v3.10.1 Build 2465/Include/Pascal/VMProtectSDK.pas
- SHA256 935c599b59ef4e70eeb3c87a05a6cb7351e0820ecbe4b425b86d47301b1dffa9
- MD5 97a96877fc2c184b0e73e85529b34822
- SHA1 1c9df39e8b82351da153d1d97efd43e300d6a652
- SHA512 ae04154dd383d18dbcdc65938381a9cba2b273faf9748021126b5e3b0b01e03300561d09ebda3ff24b7b917d58f3572be21ea291a3e4c3aed8ac2c8be062b88e
- SSDEEP 192:xZ37KYVlOuiI72qkMPWYKQZYk4kpkgkhkokbkOkwkaknkDhkpkMkEkUkikFk1k9h:xZ3zP
- TLSH T129128B754B1174CD84AA747B736FEC9A293953A0A0E1E5F7B002A7B1CF8E058750BD8E
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Include/VB6/VMProtectSDK.bas
- SHA256 d2c1334fd893071b3b7e42d0817cbd37310c831af2af12ee1f94e8f654eff403
- MD5 30d0ac58f09ba02d81dde6ea9067b582
- SHA1 b97c402bb5e423d7e2bdc438bcfc4024b1d6a7d4
- SHA512 b06e099b109506716ce8d9c25f58d3af2b870510c1f3bc33c5d5cb5a356c626285e2b4e6503cebb5b4dd0276007552416b412854b115c01d9c6e795482d48ce2
- TLSH T1EC814999E6147C7AC8A5A1E83027DCEBBCEC529535B9D393603062CF0FA28CC67D4167
- MD5 SHA1 SHA512 TLSH
VMProtect Professional v3.10.1 Build 2465/Langs/de.lng
- SHA256 5c56a15e90fcb124be61cc3ba06384016361023e56d35379f08395c1ef2eeac6
- MD5 7e20bccae3756a760ad009e5b446a568
- SHA1 636c7ae3d78d3c6ef4bbdd8fbad3ec771a58d078
- SHA512 a864b6d52a13fd8e4f56809535b2dabf1fceac2bb3ed375a013e02c09a319f47cd70a2ec5bc5a229fbd4247e2a66afd76b9dfea4691283560aa13698abda773b
- SSDEEP 192:UQmLI/xiNfj1J5CUGvJ1D4XRYIe9kZ4vPs52dzxLGk3HfVUH/EuULNP9sPRY1zex:r83IqhY7eZ2zxLGkPe6spvDXF
- TLSH T1DF3208150E08628FD3D32BB67540C86B37B4C36917B020A3088CE3E75B97D7D9B6E596
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Langs/en.lng
- SHA256 30aa31e3198d7ba46117018990b84557e564df6f14ad3fa479f38f1f7209f701
- MD5 9e54393aae67e92b15775c84c59a9eeb
- SHA1 8aada06a259e35b3e5c1901c9932db130f37d53f
- SHA512 e01204e4ff51a0ac824aafee831f4efe02909246e21cf39bd8572f4f159bb71503d8dbf42df97d665a6c6d35f9fe04ec59c3dfeed99253073e83a8e86b245f90
- SSDEEP 192:TORjTHv17nwN71QIgWSiaDNVsJG1EDN6uXxjw2UkVH/bvohKVKeElDt7deAnaR70:C/Hi95SDDnsJG2DMSxjw2U0uuAnaR72h
- TLSH T10822C50D2704629715D301B7AB52CCA3A7B5825C6674020718ACE7A827E7D3CEBBBAD5
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Langs/fr.lng
- SHA256 b35d3bab6a63e8191340b9b18a5ed5e0eb86fe65f9dfe9d17696839a102314e3
- MD5 eee0c8e57a4d0a3dcfb1bcbf50e5b9b9
- SHA1 cb1d6cdf7ce3433a706f436e7cfd3770b01ebe11
- SHA512 f759b0c77e7392d2e7842372027bf174218b536d7e23d229bbab30b0f558c4b30711e826a3f28b4c372334a493af1453d13e9f910f1ba153e30fb0b0f5a60193
- SSDEEP 192:aj2o6S4kp87L1NG3Ck2dM0x10NZapGYx1MvvWmPyYNNtPAhcy+LVS9n2rfgiXl87:IT3b2+08TY1MGmPyYa+h4nIoiV80S5
- TLSH T1BD32B50EBA80614763D312F7B552D527A638C2547A19F2064CC8A7E863EFD3CD38F999
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Langs/ru.lng
- SHA256 4672c6661f7ee9db43a485a31ad3070b73d90f3a344c2a61710fd93819515397
- MD5 180ea2002c6f9e6e84df1cf91afedf9d
- SHA1 88f5e301ec9bc1133b5adb4781443a58063ce8ec
- SHA512 8e22f9bb34aa15f9457f27a55a5a54a2c30c2b8bf4c8bc16665c95e2c4a62cb7305b44f25ad76812a3a6abe2444e58ddac66b720a9a5c4275dbdc58993f7535a
- SSDEEP 384:Fr2mIZLqvfh2Eu7Ebi0FxF71Ki4aRkjEPve4AN8V3rse92OQqa4k:Fr2P7SxFRRDz92OQz
- TLSH T18AA2F34FFAFC5114B5B6DA40AF3189D206EAB7102B19C0DD86CF2C5A1478AB477227E7
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Langs/zh.lng
- SHA256 39ff0ffe1532ed801b8ca99ebf8bc7566b2dd5b4b18645e2319c5da796b110c5
- MD5 de13bbcc687ad3762a073f102b99e95c
- SHA1 a3a721d5c610fe0ee5f6eb60ea6c97f291bbf2d4
- SHA512 a4bc69f4bc419008d4d86eef4ecf32ddd5c285fe18571c81d62a8bc99e2feec6471ad156a783b7aabe5851bcc826ef1be79d1ad304a80ed9a2ff18ec620649a4
- SSDEEP 384:ENm0bnMYC5qftk8ns3CMUitEJURa2RBaOzI/9XPZO:ENmUI4n8CMQiRdzI/9XPk
- TLSH T18A52540127FE6019F6F79F98EAB894564BBBBC261E1DC12D95C4404E18B1E808A777F3
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Linux/libVMProtectARM64.so
- SHA256 37a0a51b5d645821587021b680ca14b96e6db3a48208b81664ee46dfa54d24bf
- MD5 b16121b3ee680412a8019c80b301d596
- SHA1 cf918d600f5b941002898387129c5be18dcd7dfa
- SHA512 55e8738aa7e008cfe5dc92ab5e02d590ea1b94c7b497ee85c560a577b705d108afca08362f20340df5dedd80a5c454d0725ddc7066e3285cad0856ad56223bc2
- SSDEEP 192:zu+GlN8pgCDqo8jDjoI6vLJzwbsdyzI0rsQ9yA3G8aYfMwxwC8:AbCDYjDjoI6vLlwIyzhrsQAAm/0Y
- TLSH T19A92C805F894ED2FCCC1A2B5555B4FB073229418A367DB47700A42652E833DEAF5DACB
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Linux/libVMProtectSDK32.so
- SHA256 71e22f226088af6d0dfb66a5867679be1b5354d2c2d68553debba101cdf19368
- MD5 4eb0696adbe805c3af5036cbb1cd8dc1
- SHA1 447af531be7ff3ce16df12c02ff9c4839bde923a
- SHA512 fede88e5522d9049a81bf164bbabbd9091c76bd39f9c4912438585da5c6e75bf5e2cd78f5fa7ddb07a9805eaf9f2275076fc67f0e4dc83805534d3c98b98385d
- SSDEEP 384:16sStAggRgUFIjDmFf47Pej/ro7fCoBypJ:16FyfRDFIjDmHJ
- TLSH T16072F843EF85A5BAC4C74174212B9F2E657484314A72CF63BA2C17645E633EC3A1678B
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Linux/libVMProtectSDK64.so
- SHA256 7cb456b4f156318c827c6b3f921425f7b76d013906637b67be6cfb00d52963be
- MD5 2e2df3253a7bad7814919ac71c2a612e
- SHA1 1c66c284627bed18de1b22b291ea5a175887ae44
- SHA512 079640db4117cff49476d5bfd4a91fb418e64568031b70918612dfac4f4543a617483af35e2a4b111f0c612f03e541c578fce51e0f0038bb4b217a0f2f2798d3
- SSDEEP 192:ReQSVL8pgBEZwF4LPWNxG4PeOW/FwecZVNQll/aHtHn2wWIwf5x3BmpD:F4R6ZwF4GEjOjziqx+IWx4
- TLSH T1BB82A64BB5819D3FC8C6C3B0921BDFB065B0B4909762CB6372108B791D527CC6A6BB4B
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Net/VMProtect.SDK.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 70b42fdef32ab9a3c1e67fe91287671db3754cb04b960f52c4edd60bedbb7c0f
- MD5 f09b6a237c55c58ef9d2ad03c69ecaba
- SHA1 390269fe9d33749367739cdf7720859dcb0bacb2
- SHA512 c79d8b6449109c25b8041cb2de5b6d246ffb1213ea5e9ab4c43d7325f08ff57e8bc4ae540d9db91f9eb5cf4bb468fc7d37df0fd6d48a6393143396def97bb64c
- SSDEEP 96:vbeBWY8lNW5lleUWbgjaJvbdI8cH4YJNSscbNVOz8RpFxrPOPXCr3c79sLtFSVF:xY8zWUUOgjSjR+JxzwFxrq88
- TLSH T16D22B712B3E8A156F5FB67356D7211310BB7BA994A76CE3F148C010F0B37A546BA0B63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15898
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/BCC64ELF/VMProtectSDK64.lib
- SHA256 7478ad433d98332db316a388d368d9a80f2122f56187b8f952b73426bd05ca00
- MD5 a1d97d2027dbc52867681e6835991499
- SHA1 cf4f3106693ece055ce0806ef619b034cf5ef549
- SHA512 5f0c45ada9ba0c78f1a89fb260c8a39564f98458a97e1c979681e9ed0b35a63b36f2fdf8f7c085236daab87ae3936bc8ad382ab58d57574717be918c6bf85459
- TLSH T10C51E11C8981392FC5F690FA3726DDB4B275804681F2C757711D63A08B633CF6B9668B
- MD5 SHA1 SHA512 TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/MinGW/VMProtectSDK32.a
- SHA256 56dcf0fbbe7c5679d9296771a34f6139c4636f5f0ff174fa50bce0321878eac3
- MD5 d713d0f3faad4d88452647dec4f299f1
- SHA1 097746cdd77255cc58155bb2416edda4e0b545ab
- SHA512 15e4c4bbc73f5a9a29eef687644dd66d0c78bef1c3f2a65896b1ec95d8659281ce78286ed1b84f47f092e44250a02ef027fd080d5bc425e8b8d0e2eae74b8308
- SSDEEP 192:e6gR0E4kg/Jcs6bfuMVNjL+tcESM0p/ohO/7j:6R0Fgghe3
- TLSH T16B92C2B2B6965DCBD6B240BD9557EF21273CF0E24A66CB37322C64600BD1E893EC2547
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/MinGW/VMProtectSDK64.a
- SHA256 a8cd1e08036d8d66761bb93dd158aac7afd3c9c0d200e83ba51b88fe32c4b5b0
- MD5 75692c8f8714ecfd22f3476f4a78ca3d
- SHA1 f59a9074d80edf81770a5d9567755f5746234c06
- SHA512 f4214270a5a9c1e2d634e7f30bf18d0f124c289865e69c4f9103e17348a676c87f874b820b9ff8fa460c7a19e99b183dbbb0a48b12d5cdc4424d7c0167d0b892
- SSDEEP 192:yuZ+T2irUmQHddQtMJOSRQEC281bHASCA:yi6
- TLSH T1FF82E1B2F6A25C8FD6B581BE5656EF252B7CF0D20162CB27322C19300B92E953FC5587
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/OMF/VMProtectSDK32.lib
- SHA256 06497f7b7d9670bdc832506b00707eae521f310eaaa5998ec6f6f4bdfadc1e87
- MD5 0e1a96050ea2afc299dc4d05a327b044
- SHA1 0627d91000c0e06c4a8d8c80d257ffc709ceb688
- SHA512 309518a1a6d23843f675d0e2173f0f85f5adc3049eed9b91b8cbe64796d8ab166ca0f9dc82c43c85102cdfa2b8e54978a459fe097486f2ead6557e00288e3f46
- TLSH T1BA71373A19513A6FC4E390FA2A56CD9AFAB471D51AF1C573A7A111BF0F2E08C372504B
- MD5 SHA1 SHA512 TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtect.dll
- SHA256 51c3ec0c0c784308818acc1c57449ea171fdf03d20012e82b0c9796783c77042
- MD5 f33584cce34dbfe0e5217e05c5257207
- SHA1 23bd69db49b92f82b7499e2666c6a7f46f0a9c36
- SHA512 7165d5a84e5de0b0ad699d177e2346204ad08bdccf9b1ea77fc99f57f3923e914f264297ed90c83ae1715ae8d0f87172652d2c510056b2b6bdd507f951ae90b8
- SSDEEP 786432:N3TDZ13jSjgDf5RzjHa7KSWxx4/DMRzxxRo0CX/G1z/QKqBjA3S/JRGTwENo/72d:NDDZBsPW2DMT03Xeh/gA3ShK67vhSV
- TLSH T187283337E66AE9BCC5B3C674009ADFF26F313C240774E64706D593AA4E32550EA2942F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
8d:b9:d0:b2:ca:4f:3e:4b:d8:21:87:f1:46:78:b5:97:23:ef:a8:34
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
Chains
Oct 1, 2025
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
Serial Number
07:25:df:15:2a:5b:89:92:f3:68:49:ae
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 23, 2023 - Jun 17, 2026
Minor OS version
0
Major OS version
0
Entry point
4618
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
VMProtect
Name
Size
174KB
Virtual Size
174KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
384B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
74B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
1024B
Virtual Size
980B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
949KB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
46.3MB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
724KB
Virtual Size
724KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectARM64.dll
- SHA256 733076b40828b2aecc0bf734f7cb829156475fd11c5988c79c36c8dbfb63f212
- MD5 fa22e2b2c57548ceb1b38249c4a6eb53
- SHA1 d1348e4bb42e328ffbc7cf2a40ecba2063c30922
- SHA512 74c34d81e8df8d3834abe604e0757a1ca3ba78a53b84f4abb5ae26b5cbe27066bf57a6bcf6d2c52ad16fad2e53d6456172547d15e945eb88cfd3b0a15bba5345
- SSDEEP 1536:VU+1J51mU+VWmfsLm0wTYJ6k+i+jpCJmQ/TvTsWH0dh4pISW:VU+1J/2WYKm0RJnFrTVeWu
- TLSH T13AB34C53A79D2807E1E2DB38E4574F50633FB93484248E4AB202425CDD97BC9DFB6DA2
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectARM64.lib
- SHA256 142975836dc75bb832b358c5881ac7c19754167ea68bdb5f3ae20c3695266d89
- MD5 854bd1297ef42078aac9abd31e4e710c
- SHA1 ce294326beb592b309aa866ac78a630f4ea1d786
- SHA512 4c31e0d4a04c78302e3068fb8fbcb9ea1cc37f3587cacc41ac92ea76dc8f3bea5b101e707a8fae8a53d6b93b5cb31ae924429f3854beca330fe507f3b2c8a52d
- SSDEEP 48:9ZN/k5RLRzRCRXB6cI15AXy/F/CRcRj15T17RLRyIBrJcX43KNyAOoIKAI5/KwM1:9PkqBi1brZ3KGK/KwMWTbrno
- TLSH T180E1A9365951BC2FC4EAC0F97B62DCA4396D004602F2D57BB28D269243B275F67C268B
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK32.lib
- SHA256 60ddda0ec90a4b740533c70cf4a744e1ee4f9b08d95905c9d4a97582253c7a6f
- MD5 bcf87b4739a974ce480b96b7da7e496a
- SHA1 b54e93f5335babaa84a871b2eae67906ee4a27ad
- SHA512 c5f026cf28ca53b6e8641f1d928f56e1ab9e9b9c7025fb05a8b42763145e84dc3b246cd21da9593c1a6c1fb171f61dd14208655d022fd0767a0e1e8a4446ef41
- SSDEEP 96:Wkm/+uYlVlAKU3v/hkn//K5KAK9RLv/bk:JVlU/hWXR8
- TLSH T1CFF1BA3B4812BD1FC8F6C4FAE2E3DCB9356C344A01F1C62BB51D54A163F56AD6A5A00B
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK32.sys
- SHA256 b2086b96ea10e4ebefee48802a114da2fd41d7e25ecaa459043bc19a5d50f8b7
- MD5 55640c6989b8c603cf163003c677aef9
- SHA1 5a7af5ea930353b840f6e1a314fada9a9456fd9d
- SHA512 e0c290dd803a598af42b08902adc572fb0e5c1c319ed84a686d8bc412410278bafc892111014e13cab3f7200eb0e19c82b7fa45e8a76d822178c24c57ccbbf3b
- TLSH T1625188068951763FC4CA80F93B66CC263478411153F6C3D79721072567813DF3A3D58B
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
854B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK64.lib
- SHA256 a60479152fd657bfb5f7e8a14177ae73bdcd95b8349d90aee1cb16f65e4f24c9
- MD5 378c8691093f4b2b04a808b11824e368
- SHA1 3857e143dc5b8031dfa0ffcbf71aeb6a08136ef5
- SHA512 17bf5be10d280d2681128be4bb735cead8f70dfe48efcc995aeed5558e0413f88dbe13934151184dac858c1c0403ae5757447cc1b98bd3e7c8b5d23292ce5d4c
- SSDEEP 48:NZj/k5RLRzRCRXB6cI158Xy/F/CRcRj15T1sRLRyIBrfX4nKryAOFgKbT5PKKlmM:NNkqBy1CrAnKPKtK2yZgBFB
- TLSH T17DE17A395452BC4FC9FAC0F97B26ECA83ADC444112F1C59B354D1AA187A23BF638660B
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectDDK64.sys
- SHA256 6b0f3da7f037efa22a74928503539c7fc7748dd1ab7eeb89d4e4579270698750
- MD5 cabbc368a325017a4583650efa3664f5
- SHA1 63a2a177c82ae8fe16fc8ce47df64e6448fa7ea9
- SHA512 3ef7592f0e9c7a6267cef2f9cd6b8ffbf17134506d48b572aa5cd61016c1c2395fac3caf1e312cdfb7417700e6240936f8c3c1baecea17f0f6eca88941d3ae9a
- TLSH T1835134028982756FD0D9C4F93B66DC6634B8010253F7C3D7A76217665B827CF227D58B
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
512B
Virtual Size
115B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
854B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK32.dll
- IMPHASH b9f19b4d3ce951c4ff6196681bbb3439
- SHA256 96f8f1c28842f1b1330bbcdcd538b36500a19bee2d0410d90b2a03d36dfbd2d9
- MD5 05a8eed1e19e9ae03b32a05d5aae3ef1
- SHA1 fbbd1dab6469bdcc1308ff5e231d575c84230b88
- SHA512 ae252131d716112ff325086c6c7c5e5febce5a91018c71095d48e45169b759d2e65fc6a3cd0f77d00f769758ebd18d4c72669d60e93a07e0576d459d3da20dd9
- SSDEEP 1536:hdCLkS9NLTQC2mCk6snno6EaXuu5Zf8VnTOcG9P6ggPoJQusWMIcdQUHYkFTGF:4QC2mCkVEaeu518ticG9syMJQUHYOG
- TLSH T1A7A36C10B4D1C432E0BE19380475D5A15B3E7930EF64AD9F73841AB99FB42D1AE39E2B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
8197
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
DecodePointer
CreateFileW
RaiseException
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
64KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=124, id=243, version=40116,
count=25, id=242, version=40116,
count=17, id=259, version=24123,
count=21, id=261, version=24123,
count=16, id=260, version=24123,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=89, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK32.lib
- SHA256 b512cd17d442bd7ba379d3aba65474b93c24e8cbfb5e5dd93af446ba95a230dd
- MD5 1064a15f7ac32e8918edf0b8dced2319
- SHA1 d520347b22cd2f4eef0bb033ffda9d2894557c71
- SHA512 3b677b27a063911f49344324423d4b341c7186cfa2a0fb1ac25c031f083de95b91f7a49e2a39006128559576151baa0ab5fb724b3808107bd3a46a1bdad2d87f
- SSDEEP 96:iCm/+uYlVlYKU3A/hkn7NbKvLkKD/K2CM2L7r:nVlz/heNYn7Cf
- TLSH T142F1AC3B08227D1FC4F6C4F9FA93EDA9B56C344605F1C22B706D14A223AE59E774A107
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK64.dll
- IMPHASH 1851ff453adce0cef5274e320d5bed3c
- SHA256 286df1fc125124f8cb1cc45df6c06cda41c24ff3d2b8f7909653e582cd957ec6
- MD5 47a34fd3798ea9219d145752779db913
- SHA1 61264270f952f647ec21cbbaf50fc17ce9dec783
- SHA512 8a69f804ec007254cff18073471d948ce53ad4b8d3ad8bd364d5dc79cccf90fdd6849966fa747e3f76f4d0255de52f552a72ab032e6bbf01340f2c92560e3258
- SSDEEP 3072:b/QKaiM55KiMAeMnPaiJMUPrJqYX6UBsyBx4:riiM5QixTPRJTxXaaa
- TLSH T11FC37D4B73E540BBD1B6C679C9238A55D7B678150B20DBAF07A402162F633D18E3AF72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
8832
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Name
.text
Size
67KB
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=241, version=40116,
count=124, id=243, version=40116,
count=14, id=242, version=40116,
count=7, id=259, version=24123,
count=20, id=261, version=24123,
count=17, id=260, version=24123,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
VMProtect Professional v3.10.1 Build 2465/Lib/Windows/VMProtectSDK64.lib
- SHA256 02f1ca0dd3e0fdf256b8879800a654c7efa606c909c95a77c5045c567bbbf5ff
- MD5 3a5a96f6e8673b715c1efd8a56b4ccb9
- SHA1 e7eb6a52751416f3d5672c9ea73c378872dc7212
- SHA512 97b3daee78a17c500bb06de9e241b7b2023c3d4c7c4ef076bc515b902881979329433cb14fe38aa4040db8ddcae0a9df29531a544bb4ee706bdd154aa38a1648
- SSDEEP 48:AZ5/k5RLRzRCRXB6cI15pXy/F/CRcRj15T1tRLRyIBrNX43KXyAORMKa25vKYCRn:AjkqBD1xrq3K7KXKYOuQOqH
- TLSH T133E19E3E59A13C2FC4FAC0FA7B25DDA93E9D005102F1C65B758E1AB2436635FA346207
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/Lib/macOS/libVMProtectSDK.dylib
- SHA256 bc50439dbb769a011a4a1b5b02643d6887df391a02bfea6d96f8043211492ecf
- MD5 7a55e1eea9c7e0e5e48f14628381e70a
- SHA1 bdc41376af32a2fee4e4a068e7215de09114d854
- SHA512 282c0064be097f8553d10c0ede9d6fc8fe620785f4892aef8e1de60a88b6eb2b3985e5a86556bce163ca535cd2071766b4c97c57530b7150be2a2692bed0ddb1
- SSDEEP 768:gM3wmZwZIYVsaZpJ732KaQQu8b+ss24d68Rr:nFw1VPz3q4124dpt
- TLSH T112A30707AA09A427DDCE80B4A19FCF77B036F0601177C667B661D2685FA5BC83D5640F
- MD5 SHA1 SHA512 SSDEEP TLSH
VMProtect Professional v3.10.1 Build 2465/VMProtect.exe
- IMPHASH db0b0b8200ffc7c6862fc52cc3b3cb70
- SHA256 00de1a25eca87f99f02666d21691e70a418f1fbfa10019881564d41ef753ea76
- MD5 97bc763ce2ee36e68066d6fba1b0409d
- SHA1 804d84eb5f8d7803871710a184a0b0e77bd05ccb
- SHA512 d9c90fe7c7f30ac7eec8e237362f7e1df0ba88a6935eb29aa01c69cd1a0fb59a93af1c2bbba25e791fb91819ce6996468f9251e304254ff9844c56387ab531c7
- SSDEEP 3072:C0fFEMq691ybjFgMAGo9i4LstJSZdDj2izZoMDHH/ezykXSj41GMee0oT2/Y:PqE1ybbXilF4r2/Y
- TLSH T187870EED2C701E46D40CE9B31E177F24069E7ED894E74142A294798B2F7B2B39EB6113
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
PE Signature issue
Digest
17:4c:50:ab:81:c5:f0:d3:19:4f:32:4e:44:d3:a2:e9:85:0f:ee:54
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
Chains
Oct 1, 2025
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
Serial Number
07:25:df:15:2a:5b:89:92:f3:68:49:ae
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 23, 2023 - Jun 17, 2026
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
GetTokenInformation
OpenProcessToken
kernel32
CloseHandle
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeLibrary
GetCurrentProcess
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetCurrentDirectoryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_fmode
_initterm
abort
atexit
calloc
exit
fflush
fprintf
free
malloc
memcpy
setvbuf
signal
strlen
strncmp
vfprintf
shell32
ShellExecuteExW
shlwapi
PathRemoveFileSpecA
user32
MessageBoxA
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
1024B
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
440B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
338KB
Virtual Size
338KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
VMProtect Professional v3.10.1 Build 2465/VMProtect_Con.exe
- IMPHASH caa3f8b592ed8873e835fbce7c82cf67
- SHA256 adbee789c633af3a0ec7402d9d22cb6dfba0a5f1acefe2e65c9259717f5b9321
- MD5 a277676fcb61d533e6b0f72e7ab4165a
- SHA1 29809183a87e1d524084a13a608e78ef062bee2d
- SHA512 f6ce90f1f90667769c905a9611f257cf66da305475532afa28df7f5ab5f52f96ae1965a4bca43753774472fe1d1876accec5d0623b896f7515a8c58ebdc7b2d9
- SSDEEP 393216:ELHzpe1AllcjLfo03xPUPWaR4iYwJJKb6+Qz2QND6fKLHcagHk5bX+T/:ELHwAlyjLpxPUtXYwGMimDU8gS+7
- TLSH T1AA4722AA3CE091DDC716CA32EA461AF8E19E7DD94C76441B7F8525012E32967CDF2C32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
e4:83:27:2a:0f:69:85:03:7a:84:92:36:19:59:c9:15:70:7c:e5:03
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
Chains
Oct 1, 2025
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Issuer
CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Mar 18, 2029
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=Permyakov Ivan Yurievich IP,O=Permyakov Ivan Yurievich IP,L=Ekaterinburg,ST=Sverdlovskaya oblast,C=RU,1.2.840.113549.1.9.1=#0c10696e666f40766d70736f66742e636f6d
Serial Number
07:25:df:15:2a:5b:89:92:f3:68:49:ae
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 23, 2023 - Jun 17, 2026
Minor OS version
2
Major OS version
5
Entry point
46779639
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetVersionExW
ole32
CoCreateInstance
psapi
GetModuleInformation
advapi32
CryptGenKey
shell32
SHGetFolderPathW
Name
.text
Size
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
17.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
229KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.qXJ
Size
Virtual Size
12.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.[[3
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.+i;
Size
23.6MB
Virtual Size
23.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
339KB
Virtual Size
338KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
164B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ