Malwagon
file icon
VMProtect,1.exe File Analysis · first seen Oct 23, 2026 16:12 · 27.4 MB
1proc 2files 3IOCs
Suspicious35 Completed Public
Get sample Report Sign in

VMProtect,1.exePE analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

43.9sto launch
35telemetry events
7observed
66agent notes

Suspicious

35/100

0 points past the suspicious line at 35, 35 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+35
Inconclusive
  • This run did not finish testing the sample, so it is not cleared. Read the analysis notes above for what was missing.
+15
Static analysis
  • Packed (unknown/custom, confidence 76)
+0
Execution
  • The capability analysis did not finish (capability analysis timed out), so what this file is able to do was never established. The result is inconclusive, not clean.
-15
Code signing
  • Valid code signature (Permyakov Ivan Yurievich IP) - trusted provenance; heuristic score discounted below malicious (no definitive malicious evidence)

Model reading

Measured SUSPICIOUS35 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran moved the score
Dynamic ran no points
Threat intel local feeds only no points
AI not included

Sample

TypeFile
MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10
EnvironmentWorkgroup
InternetIsolated
Execution145s
Guest hardware2 vCPU4095 MB RAM

Detection signatures

2 detected
Severity Detection Evidence Layer
MED
Packed with unknown/custom
MITRE T1027.002
packer unknown/custom packer identification
entropy 7.97 file entropy (8.0 = random)
static
MED
TLS callback (pre-main execution)
MITRE T1055
pe_header IMAGE_DIRECTORY_ENTRY_TLS present callbacks run before the entry point
static

What the tests returned

9 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

TestResult
Persistence mechanismsnone established at runtime
Cross-process injectionnone observed
Payloads written to disknone observed
Network connectionsnot tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Behavioural rule matches (Sigma)none observed
Known-malicious hash (reputation sources)no source reported this file
Local anti-virus enginereported no detection
Capability analysis of the file's codenot checked - the check ran past its time limit and was stopped
Anti-analysis / evasion checksnone above the reporting threshold - the anti-analysis calls this run did make are listed with their counts

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

  • The file carries a code signature (Permyakov Ivan Yurievich IP).
  • The local anti-virus engine reported no detection.
  • No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: packing detected.

Instrument coverage

3 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

LayerRanWhat that means
Runtime anti-analysis watch measured Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing.
API call sequence measured Measured for the hooked anti-analysis calls. It is not a full API trace: the sequence carries interpreter spawns plus the hooked anti-analysis calls, and nothing else.
Explicit module loads measured Measured, with two limits. Only a module the sample asks for by hand is recorded, so one brought in by its own import table never appears, and the hooks arrive a few seconds after a process starts.
Network capture not on this plan Not included on this scan's plan.
Live kernel introspection not measured Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature
OpenGL
Packed VMProtect(new)[DS] Trusted signature
LibraryOpenGL
Identity
File
typeexecutable
size27.4 MB
file arch32-bit (x86)
subsystemGUI
entropy7.9698
date2025-10-01 09:08:35 UTC
version3.10.1.2465
productVMProtect
languageEN

Antivirus engine

no signature matched signature set 28162 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature setValue
Set version28162
Signatures in the set3,642,894
Set published23 Oct 2026 06:24 +0000
Age when this file was scannedsame day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

44.5 of 100 8 strongest of 2568 features

A gradient-boosted model running entirely on this host scored this file 44.5 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.

Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.

Structural featureWhat it meansPushesWeight
countersigned at When a timestamp authority countersigned the signature (1759316608) towards benign -1.4687
image flag dll Image flag: a library rather than a program towards malicious +0.8678
certificate chain length How many certificates the chain holds (6) towards benign -0.7975
security directory size Size of the security table (11744) towards benign -0.6781
readable executable sections Sections marked both readable and executable (3) towards malicious +0.6047
optional.sizeof_code Total size of executable code (14428160) towards benign -0.5600
security directory address Location of the security table (28695040) towards benign -0.5173
section vsize .zcu Memory size of section .zcu towards malicious +0.4061

A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.

Packing
Packed with unknown/custom
Packed code is compressed or encrypted on disk and only appears once the sample runs.
76/100
packer confidence
Detonation is the reliable read here A packed file hides its behaviour from a static pass, so the verdict leans on what it does when it runs.
Evidence 10 signals
  • Executable section '.text' has zero raw size (unpack target)
  • Executable section '.zcU' has zero raw size (unpack target)
  • Executable-section entropy 7.98 (encrypted/packed)
  • Unusually few imports (12)
  • Entry point in non-code section '.x1/'
  • Non-standard section names: .qtmetad, _RDATA, .zcU, . `/, .x1/
  • Unusually many sections (12)
  • High-entropy overlay (7.64, 11744 bytes)
  • High-entropy resource (possible packed payload)
  • High-entropy resource (possible packed payload)

Family configuration search

Not attempted

The sample is 27.4 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.

Sample size27.4 MB
Bound16.0 MB
Limit reachedSample size, before any parser was loaded.

Capabilities

1 behaviour bucket · 1 high-risk
SeverityCapabilityMITREAPIs
high Privilege escalation
Adjusts tokens / privileges
 T1134 openprocesstoken

Security mitigations

partial posture
ON ASLR (DynamicBase)
OFF High-entropy ASLR (64-bit)
ON DEP / NX (NxCompat)
OFF Control Flow Guard
OFF SafeSEH
ON Stack cookies (GS)
OFF Force Integrity
OFF AppContainer isolation
OFF Authenticode signed

Sections

12 sections · the file's memory layout
SectionVirtual addrRaw sizeVirtual sizeAccessEntropy
.text
Executable code
 0x1000
0.0 B
13.8 MB
expands
EXECUTEREAD
0.0
.rdata
Read-only data
 0xdc4000
0.0 B
20.1 MB
expands
READ
0.0
.data
Initialised data
 0x21e2000
0.0 B
172.2 KB
expands
READWRITE
0.0
.tls
Thread-local storage
 0x220e000
0.0 B
13.0 B
READWRITE
0.0
.qtmetad
Non-standard section
 0x220f000
0.0 B
272.0 B
READ
0.0
.gfids
Control Flow Guard map
 0x2210000
0.0 B
2.3 KB
READ
0.0
_RDATA
Non-standard section
 0x2211000
0.0 B
304.0 B
READ
0.0
.zcU
Non-standard section
 0x2212000
0.0 B
12.2 MB
expands
EXECUTEREAD
0.0
. `/
Non-standard section
 0x2e3d000
512.0 B
136.0 B
READWRITE
0.8989
.x1/EP
Non-standard section
 0x2e3e000
27.0 MB
27.0 MB
EXECUTEREAD
7.9769
.rsrc
Resources
 0x4946000
339.0 KB
338.7 KB
READ
5.0472
.reloc
Base relocations
 0x499b000
2.0 KB
1.9 KB
READ
4.4634
code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

12 funcs / 12 DLLs · 1 suspicious
▸WINMM.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
PlaySoundW 0x02e3d000 - -
▸IMM32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
ImmGetDefaultIMEWnd 0x02e3d008 - -
▸OPENGL32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
glBindTexture 0x02e3d010 - -
▸WS2_32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
gethostname 0x02e3d018 - -
▸KERNEL32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetSystemTime 0x02e3d020 - -
▸USER32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetCapture 0x02e3d028 - -
▸GDI32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetOutlineTextMetricsW 0x02e3d030 - -
▸ADVAPI32.dll1 func 1 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
OpenProcessToken 0x02e3d038 - T1134
▸SHELL32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
SHGetFolderPathW 0x02e3d040 - -
▸ole32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
OleGetClipboard 0x02e3d048 - -
▸OLEAUT32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
SysAllocString 0x02e3d050 - -
▸PSAPI.DLL1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetModuleInformation 0x02e3d058 - -

Binary metadata

what the headers declare about this build
Resource langsEN
Debug infono
TLS callbacksyes

Code signing

Trusted signature
Permyakov Ivan Yurievich IP
issued by GlobalSign GCC R45 CodeSigning CA 2020
Signed byPermyakov Ivan Yurievich IP
Issuer (CA)GlobalSign GCC R45 CodeSigning CA 2020
Valid2023-03-23 → 2026-06-17
Serial0725df152a5b8992f36849ae
AlgorithmSHA256-RSA
Verification
Embedded signature: OK
Chain verification: verified
Provenance
The chain verifies as of now, so these bytes are attributable to the publisher above.
Signed at 2025-10-01T11:03:58+00:00 proven
Countersigned by DigiCert SHA256 RSA4096 Timestamp Responder 2025 1 under DigiCert Trusted Root G4
Countersignature form Legacy countersignature an attribute carried inside the signature itself rather than a separately signed structure
Authority revocation good this authority's own certificate was not revoked, so the proof above does not rest on a withdrawn identity
Dated by This platform's own verification of the countersignature - the same reading that proves it, so the moment the chain is judged at and the proof of that moment are one thing.
Second reading 2025-10-01T11:03:58+00:00 agrees with ours
Second opinion verified an independent verifier's separate answer about the same countersignature, kept so the two can be compared
Certificate chain (6)
SubjectIssuerValid toAlgo
DigiCert Trusted Root G4 DigiCert Assured ID Root CA 2031-11-09 SHA384-RSA
GlobalSign Code Signing Root R45 GlobalSign 2029-03-18 SHA384-RSA
DigiCert Trusted G4 TimeStamping … DigiCert Trusted Root G4 2038-01-14 SHA256-RSA
GlobalSign GCC R45 CodeSigning CA… GlobalSign Code Signing Root R45 2030-07-28 SHA256-RSA
DigiCert SHA256 RSA4096 Timestamp… DigiCert Trusted G4 TimeStamping … 2036-09-03 SHA256-RSA
Permyakov Ivan Yurievich IP GlobalSign GCC R45 CodeSigning CA… 2026-06-17 SHA256-RSA

Capability detection

not completed

The capability analysis of this file's code did not finish, so what the file is able to do was not established from its instructions. This narrows what the run covered - read it alongside Coverage rather than as a finding about the file. Cause: the check ran past its time limit and was stopped.

Signature matches

2 findings · 5 file properties · 0 scored
Rule What it matched Corpus Weight
maldoc_find_kernel32_base_method_1
maldoc
No description
2 of 2 strings matched
$a1 d\x8b\x0d0\x00\x00\x00 at 0x17717
$a2 d\xa10\x00\x00\x00 at 0xc51a42
Tier 3 - community corpus
casts no family vote; every measured false family match came from here
 SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
possible_includes_base64_packed_functions
Detects possible includes and packed functions
2 of 2 strings matched
$f btOA at 0x280d57
$fff This at 0x4e · 98928 hits
Tier 3 - community corpus
casts no family vote; every measured false family match came from here
 SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
File properties - not findings
IsPE32IsWindowsGUIIsPackedHasOverlayHasDigitalSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

None of the rules above moved the score. The score model reads four rule categories - anti-vm, anti-debug, dropper and packer - and a rule outside them can match, and be worth reading, without being evidence the verdict is built on.

Extracted strings

showing 179
  • !This program cannot be run in DOS mode.
  • .text
  • `.rdata
  • @.data
  • .tls
  • .qtmetad
  • @_RDATA
  • @.zcU
  • `.rsrc
  • @.reloc
  • QOuw
  • q*URW
  • W.PH)J
  • ylst
  • !ckt}h
  • DChl)
  • .sy>{Q
  • K.Uf
  • aTLA
  • Eszd\
  • ameX
  • eALJ%
  • GetSystemTime
  • \\"2
  • eibeN
  • aHL.Wq
  • \\8H
  • GDI32.dll
  • g:eBU*
  • %u-pC
  • %toXW
  • 619OWU9~00l
  • B.JP
  • HABf
  • ?INSX5gTrL
  • BenBrb
  • ewNO
  • $RUNE3
  • Dpaq
  • MAS6~V
  • Mapa
  • ~ *.yy
  • maFG
  • cnOX
  • GK:\L
  • .Io=D
  • 6IARO
  • (.DN,
  • L7dot
  • zAT-XQ
  • .Oim
  • urz+tL#
  • lefn
  • .RZD
  • ?gDRA%=DB
  • ).sr
  • #|ZRre
  • KMOOuka
  • WCBI#o>0
  • sQZNH!o?r;
  • .RS%B
  • dYER
  • &.hX
  • )$.Op*
  • Ip_kZ
  • ~.CEx
  • zonz
  • PNG&E4
  • <A%x
  • lAlBULip
  • .oG>
  • Jpi.rP
  • w.Xu
  • dFOZF
  • CALV
  • ua_MG
  • )%lbs
  • LMec
  • mYIO
  • qIDF
  • Stda
  • BTIz
  • o[nnq
  • GEksr
  • OHUT
  • seEX
  • VS_VERSION_INFO
  • StringFileInfo
  • Comments
  • CompanyName
  • VMProtect Software
  • FileDescription
  • FileVersion
  • InternalName
  • LegalCopyright
  • Copyright 2003-2025 VMProtect Software
  • OriginalFilename
  • ProductName
  • VMProtect
  • ProductVersion
  • VarFileInfo
  • Translation
  • .hf+J
  • lyy;4nT
  • cA`\\4
  • .gksx
  • `urS+P
  • .UrkG
  • 8%ua
  • `.IQ
  • HRedc
  • EWUs
  • C.DX
  • erMN
  • 6.mF
  • ulwc.
  • Jxet
  • 44ANda
  • \lIGE
  • 7&.uU
  • h<.rc
  • kFID
  • nev 5I
  • LRc96e
  • eH(EVP
  • .mxH\E,
  • MSi*k
  • .Eh|
  • MInd
  • c@eblp5_
  • Ushz
  • //`?
  • Xgcai
  • 1KVEXh
  • gNSO
  • M%OPX
  • kcrA
  • ndYA
  • DCExy
  • leBH
  • .VtW)
  • LU_FhE
  • zonHB&@
  • ioti
  • .McrW
  • 4|u$f.Id+
  • yriE
  • F3g.HjeA
  • H%dzk
  • u.Jt
  • tVYIT
  • JIde
  • :.KP
  • _.Vop#
  • JNBe
  • 5Q.Ph
  • =Mmne
  • F*{$%d
  • 4LLjf
  • ?tiSV
  • toqF:
  • k.Gs-
  • dEKW
  • idIL
  • 78.pTV
  • R~ovmg*
  • L[9Him2
  • X.RL
  • Gjid9
  • V.SL"!
  • i.Otz{
  • |;hpEM
  • TGca9
  • .sz#~|
  • RSIHk
  • 9X.tA
  • jHDE
  • OUbr
  • ENSO

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Disassembly

entry point · x86 · 60 insns (listing capped)
AddressBytesMnemonicOperands
0x3d89a72e88cf7f9ffcall0x3d29203
0x3d89a7750pusheax
0x3d89a788d848030618978leaeax, [eax + eax*4 + 0x78896130]
0x3d89a7f9cpushfd
0x3d89a8058popeax
0x3d89a8189442404movdword ptr [esp + 4], eax
0x3d89a85b8912684demoveax, 0xde842691
0x3d89a8a8b542404movedx, dword ptr [esp + 4]
0x3d89a8ee882f6f2ffcall0x3cb9115
0x3d89a93b8bd3ab0acmoveax, 0xacb03abd
0x3d89a980fbfc8movsxecx, ax
0x3d89a9bd3f1salecx, cl
0x3d89a9d8d542428leaedx, [esp + 0x28]
0x3d89aa198cwde
0x3d89aa28d844818232c0eleaeax, [eax + ecx*2 + 0xe2c2318]
0x3d89aa9668b84022ba2d3b1movax, word ptr [edx + eax - 0x4e2c5dd5]
0x3d89ab10fbed1movsxedx, cl
0x3d89ab46633d0xordx, ax
0x3d89ab70fb64c27ffmovzxecx, byte ptr [edi - 1]
0x3d89abcb8a9e58743moveax, 0x4387e5a9
0x3d89ac1c1c016roleax, 0x16
0x3d89ac40f83b406d800jae0x4b0a17e
0x3d89aca32cbxorcl, bl
0x3d89acc33c0xoreax, eax
0x3d89ace2bc0subeax, eax
0x3d89ad0f6d1notcl
0x3d89ad20f97c0setaal
0x3d89ad5c0f8e1saral, 0xe1
0x3d89ad880f10axorcl, 0xa
0x3d89adb32c8xorcl, al
0x3d89add0fb3c0btreax, eax
0x3d89ae0fec1inccl
0x3d89ae250pusheax
0x3d89ae380f188xorcl, 0x88
0x3d89ae632c8xorcl, al
0x3d89ae8fec0incal
0x3d89aea58popeax
0x3d89aebc1f83bsareax, 0x3b
0x3d89aee32d9xorbl, cl
0x3d89af00fbaf81dbtceax, 0x1d
0x3d89af4c0f806saral, 6
0x3d89af798cwde
0x3d89af813ccadcecx, esp
0x3d89afa66c1e8e3shrax, 0xe3
0x3d89afe66c1c821rorax, 0x21
0x3d89b02c0f0e1salal, 0xe1
0x3d89b0566891441movword ptr [ecx + eax*2], dx
0x3d89b098d14c5b5948ecaleaedx, [eax*8 - 0x35716b4b]
0x3d89b108d88382923d3leaecx, [eax - 0x2cdcd6c8]
0x3d89b16660fabd1btscx, dx
0x3d89b1a0244c7feaddal, byte ptr [edi + eax*8 - 2]
0x3d89b1e23c9andecx, ecx
0x3d89b20f7d2notedx
0x3d89b22fec1inccl
0x3d89b2432c3xoral, bl
0x3d89b26d3f2saledx, cl
0x3d89b2823c9andecx, ecx
0x3d89b2ad0c8roral, 1
0x3d89b2c0fc1caxaddedx, ecx
0x3d89b2f66f7danegdx
callbranchretstackarithregisterimmediatememory

Import fingerprint

1 related sample
Fingerprint6:fczC2nJWXuqnO93Jvy9cABkBMOidYERzbW1bGe9CBUq568SGMKL:fc22nJOnxBS64ERz9krq5tL
Imports read12 functions from 12 libraries (12 distinct)
Comparableyes
Compared against101 stored samples
Samples built on the same import table (1)

An identical import table survives repacking, so a high score usually means the same code rebuilt. It is corroboration, not a verdict of its own.

ScoreSampleVerdict
90 3eb65619d237549c4437e99… suspicious

Screen recording

9 frames · screen recording · 146s
Screen recording frame
1 / 9
0:00 · 1/9
Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 145s

1 process(es) observed

LaunchedC:\Users\user\Desktop\VMProtect_1.exe
Privilegestandard
Telemetry sources: Kernel ETW (110 of 362 events) agent poll: 3Process audit: 1In-process monitor: 26

Anti-analysis API trace

3 APIs · 1 process hooked

Calls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.

APISignalCallsSleepScored
GetTickCount timing 10 - no corroborates, never convicts on its own - ordinary software calls this
GetTickCount64 timing 1 - no corroborates, never convicts on its own - ordinary software calls this
IsDebuggerPresent anti_debug 1 - no one call only, which some build configurations make at startup without asking the question
Call order 4 events sampled
GetTickCountIsDebuggerPresentGetTickCountGetTickCount64

How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.

Module loads

1 notable · 12 from system directories

Modules the sample asked for by name while it ran, recorded inside its own process. Loads from system and installed-program directories are counted but not listed - what is listed is a module from somewhere else, a load that failed, or one whose loader is the question.

ProcessModuleLoadedWhy listed
VMProtect_1.exe 3684 C:\Windows\system32\wintab32.dll no the load failed

What this list cannot say: only an explicit LoadLibrary call is recorded, so a module the sample brought in through its own import table never appears here - absence from this list is not absence from the process. There is no signature check behind these rows, so an unlisted module is not a module that was verified. The hooks are placed a few seconds after a process starts, so the first loads of a launch are missed.

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 910 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

1 read

1 captured text was read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

1process
2file operations

VMProtect,1.exe

1 process
1 process

Attributed activity

0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean
  • Active Setup Installed Component T1547.014 clean
  • Explorer Delay-Load Object T1547.001 clean
  • Explorer Run Key T1547.001 clean
  • Explorer SharedTaskScheduler T1547.001 clean
  • Group Policy Extension DLL T1547.004 clean
  • Group Policy Run Key T1547.001 clean
  • Logon Script T1037.001 clean
  • RDP WDS Startup Program T1547.001 clean
  • Registry Run Key T1547.001 clean
  • Registry RunEx Key T1547.001 clean
  • Registry RunOnce Key T1547.001 clean
  • Registry RunOnceEx Key T1547.001 clean
  • Registry RunServices Key T1547.001 clean
  • Startup Folder Item T1547.001 clean
  • Startup Folder Redirection T1547.001 clean
  • Terminal Services Initial Program T1547.001 clean
  • Winlogon GINA DLL T1547.004 clean
  • Winlogon MPNotify Value T1547.004 clean
  • Winlogon Notify Package T1547.004 clean
  • Winlogon Shell Value T1547.004 clean
  • Winlogon Taskman Value T1547.004 clean
  • Winlogon Userinit Value T1547.004 clean
Services & Tasks 9 clean
  • BITS Job T1197 clean
  • Print Monitor DLL T1547.010 clean
  • Print Processor DLL T1547.012 clean
  • Scheduled Task T1053.005 clean
  • Scheduled Task Registry Implant T1053.005 clean
  • Service Control Manager Security Descriptor T1574.011 clean
  • Service DLL Hijack T1543.003 clean
  • Time Provider DLL T1547.003 clean
  • Windows Service Creation T1543.003 clean
Execution Hijack 17 clean
  • .NET Managed Debugger T1546.012 clean
  • Accessibility Tool Hijack T1546.008 clean
  • AeDebug Postmortem Debugger T1546.012 clean
  • App Paths Hijack T1546.012 clean
  • Application Shim Database T1546.011 clean
  • Boot Verification Program T1547.002 clean
  • Command Processor AutoRun T1546.011 clean
  • Explorer Load Value T1547.001 clean
  • Explorer MyComputer Tool Hijack T1546.001 clean
  • Registry Image File Execution Options T1546.012 clean
  • Screensaver Hijack T1546.002 clean
  • Setup ErrorHandler Script T1546 clean
  • Shell Open Command Hijack T1546.001 clean
  • SilentProcessExit Monitor T1546.012 clean
  • Telemetry Controller Command T1546.015 clean
  • WER ReflectDebugger T1546.012 clean
  • Windows Error Reporting Debugger T1546.012 clean
DLL Load Order 12 clean
  • .NET CLR Profiler DLL T1574.012 clean
  • .NET Startup Hook DLL T1574 clean
  • AppCert DLLs T1546.009 clean
  • AppInit DLLs T1546.010 clean
  • AutodialDLL Winsock Injection T1546.006 clean
  • DLL Search-Order Hijack T1574.001 T1574.002 clean
  • DNS Server Plugin DLL T1574.001 clean
  • HTML Help Helper DLL T1546 clean
  • KnownDLLs Manipulation T1574.001 clean
  • Natural Language Platform DLL Override T1546 clean
  • Netsh Helper DLL T1546.007 clean
  • Winsock Layered Service Provider T1546.006 clean
COM & Browser 6 clean
  • Browser Extension T1176 clean
  • Browser Helper Object T1176 clean
  • COM Server Hijack T1546.015 clean
  • HTML Help COM Object Hijack T1546.015 clean
  • Shell Context Menu Handler T1546.001 clean
  • Shell Extension Handler T1546.001 clean
Security Providers & Accounts 11 clean
  • Account RID Hijack T1098 clean
  • AMSI Provider T1562.001 clean
  • Credential Provider T1547.014 clean
  • DSRM Admin Logon Backdoor T1556 clean
  • Hidden Local Account T1136.001 clean
  • LSA Authentication Package T1547.002 clean
  • LSA Extension DLL T1547.005 clean
  • LSA Notification Package T1547.005 clean
  • LSA Security Package T1547.005 clean
  • Network Provider DLL T1556.008 clean
  • Security Support Provider T1547.005 clean
Scripting & Applications 9 clean
  • Netsh Port Proxy T1090.001 clean
  • Office Add-in T1137.006 clean
  • Office Executable Sideload T1574.002 clean
  • Office Startup Template T1137.001 clean
  • Office Test Key T1137.002 clean
  • Power Automate Flow T1546 clean
  • PowerShell Profile T1546.013 clean
  • Windows Terminal Startup Action T1546 clean
  • WMI Event Subscription T1546.003 clean
Boot & Firmware 4 clean
  • BootExecute Native Image T1547.002 clean
  • PlatformExecute Native Image T1547.002 clean
  • SetupExecute Native Image T1547.002 clean
  • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 2 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

2 file · 0 registry · sample scope

File operation times: 2 timed

OperationTargetProcess
create
C:\ProgramData\VMProtect Software
same pathkernel tracepoll
 VMProtect_1.exe pid 3684 2026-10-23 16:56:56.153
create
C:\ProgramData\VMProtect Software\VMProtect
same pathkernel tracepoll
 VMProtect_1.exe pid 3684 2026-10-23 16:56:56.153

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

Earlier analysis of these bytes

1 earlier run

Earlier analyses of the identical file, matched by SHA-256. Same bytes, same questions - what this platform found the last time it looked is evidence about the file in front of you now.

RunAnalysedModuleVerdictScore
#2920 2026-10-23 16:27 File Analysis Suspicious35 35/100
1 reported a hit 9 answered no 13 had nothing to check
1Sources with a hit
10Sources queriedof 23 available
470.6kFeed records
0Could not answer

File reputation

4 clear · 3 not checked
SourceChecksResultDetailFeed
MalwareBazaar hash feed File hash clean not in feed 3,003 records
3 minutes ago
MalwareBazaar ransomware feed File hash clean not in feed 3,348 records
3 hours ago
ThreatFox hash IOCs File hash clean not in feed 1,153 records
3 minutes ago
URLhaus payload hashes File hash clean not in feed 1,680 records
3 minutes ago
filescan.io File hash not checked no hash lookup ran for this scan live lookup
MalwareBazaar File hash not checked no hash lookup ran for this scan live lookup
VirusTotal File hash not checked no hash lookup ran for this scan live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

nothing of this kind to check
SourceChecksResultDetailFeed
blocklist.de IP / domain / URL not checked no IP, domain or URL observed to check 27.6k records
3 minutes ago
CINS Army IP / domain / URL not checked no IP, domain or URL observed to check 15k records
3 minutes ago
Emerging Threats IP / domain / URL not checked no IP, domain or URL observed to check 482 records
3 minutes ago
Feodo Tracker IP / domain / URL not checked no IP, domain or URL observed to check 5 records
3 minutes ago
IPsum IP / domain / URL not checked no IP, domain or URL observed to check 19.7k records
3 minutes ago
Phishing.Database IP / domain / URL not checked no IP, domain or URL observed to check 391.5k records
3 hours ago
ThreatFox IP / domain / URL not checked no IP, domain or URL observed to check 1,153 records
3 minutes ago
URLhaus IP / domain / URL not checked no IP, domain or URL observed to check no records ingested

TLS fingerprints

nothing of this kind to check
SourceChecksResultDetailFeed
JA3 / JA4 fingerprint blocklists JA3 / JA4 not checked no TLS client fingerprint observed 97 records
9 hours ago
SSL blocklist Server certificate not checked no server certificate fingerprint is extracted to check live lookup

Detection rules

1 of 2 listed
SourceChecksResultDetailFeed
Signature rules Sample content 2 matches maldoc_find_kernel32_base_method_1, possible_includes_base64_packed_f… 110 records
4 minutes ago
Sigma rules Behavior log clean - 2,275 records
5 hours ago

Tooling catalogs

4 clear
SourceChecksResultDetailFeed
LOLBAS Process image paths clean 1 process image path, none masqueraded 245 records
4 minutes ago
LOLBootloaders File hash clean not a known vulnerable bootloader 520 records
3 minutes ago
LOLDrivers File hash clean not a known vulnerable driver 2,333 records
3 minutes ago
LOLRMM Names and domains clean 2 name/domain indicators checked, no remote-management tooling 360 records
3 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 3 suspicious 0 info

File indicators

3
SeverityTypeIndicatorDescription
suspicious sample_sha256 75cd41cf04606167d51511ad249e2ddf3a4cf760bed53a1b81b98a1eb0e4f72d Submitted sample (SHA256)
suspicious sample_md5 816e45219d7030ce28d29231b04f9256 Submitted sample (MD5)
suspicious imphash 9f46f39240fb84fa8a8d583f976e6391 Import table hash (imphash)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

No generated rules

Detection rules are auto-generated after analysis.

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2922

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

2 runs

This file has been analysed more than once. The report below is the run that found the most, which is not always the most recent one.

SubmittedEnvironmentVerdictScore
2026-10-23 16:50 Shown below Windows 10 22H2 Suspicious 35/100
2026-10-23 16:12 Windows 10 22H2 Suspicious 35/100