�YM���z��I>��ǔm�ك��/�ߙ�.jU� Kn���P�q�C V����VG1����V\6����Z�Qdq��lIH�X ,�!�'�u5��*��|��?-�+xzH�°���ČaB�?u�hk�M�8���G3�A�z,��T�a�:o�G��e#L�q����C�����%��L���ëy��(˫�������V�Ǩ�g,���� ]��O,��� � ��^��wG��yo��SBn�w/�!�M�q �_����nc&��HK2k�GI��J��� ��z�����8�� ;�w�\^��#�CS�?�-ߥ/s����ug\�_jr6R�˥���� �\X��H)�.7����[���<r����-4Y���E���7 3������ٟc�J�E��TK���)v�"�Ce�rL�iI!0��ͱ�1�� �ds泲���}�D6� u'NBn���Yנ�6�n 1ON%�$t&�L|鴭%p�ϱ��]��:M �w�"շ�d3���M�ٺ�?r�R���M5��$U�b�/O�M�|%����>eiZ��_�Er�l��ǀ�Z��Y�дr�h�v������x7UV����%���.���5���| �D(E�}��v ����������5�N6�H�j�w�y�!���#"%.�s5� [�ꔮ�Qg'j"8�XbJ���J�6��)ˠ��u�x�C��gLTF��=P�|��'w���뻡&���H[�9�߲+�Q�(�� �)�����ۚM�c�6+J�_��8�}2���t_;B����qYc����?g��Ώ~BֿI����_Ȇ�(�2�%��? q�J�:�t��g�K�6��n������F��cȃ�����9�Y�����I8�-�T����+0=R�o� 9����ۄ�zc�e|�.��H�i�V�t�1&l�\���ʧ6 ��g}h����}�s�� c��*ޖ�C��������2��D�G8�l�{�@��<���~UP+�%�<��',uʌHp�_�i����� I�s�I�#>D~�_�����҈7C3� �PD��P���ź�.���o}\J�������(В7��f�T�_j�[B�f��*�"V]7�� ,��t_��]�3�����f1L����� �1�.v�����^�3M��ۇ�<&���L��i���`��첧^D��v!Tڴ[�D�h� �ϯ��cʅ(M���l$�V�n���ł�|�6�g�죴�v�>ܕu�ln������]��T�/�bXWRC�l�%����h��\���(ˣ�t�?�K9�� �TFݕ��7��*��;��E�!p��=1a�Li%2@Ң`�a�~n��6W����E�Uo�zRJ��މ�� �ӗF����~#�|1�8�����t�\�2(�P,��C���?ClR��-<�L���8#}�cm:~xF&�@�p�[�ө����>Zc-��;n]Wy5���p�YZ�q�-� ^�M�R�N彧s} ��ވ�Nc�M�����nx4ݺS���� Fm�*�Y�\'���J� 楒7�� ������o�N{���R�����t+�-X#�6Ou�^}S�!ŮH���j��,M���<�H�F̱y2o�A��s����B�^O������@���W�Bv �E�IU?Z����osm�������-�����#�{P�g|��'� ����ė? 1AU���߶��o���xpQ��,�1/:ͧ�$5���\����\��}3���4O�ڗ�}w��Ktq��8u �����i$�.�� 7�3���~_�~ $nj"�/Zi���̉P}F��Ŋ%G��q���I �{{��tͣ@l�1��u$�9��T���`���x$m�}0�����"�����!<�8$R��c'�U��LYͮ�'��\|��5>Z�s���e9Nh*���6M��["u�o)Q����۽��m�o�MZ��� 8��o�\OC�T���Y �����aj�{����Lw���Hq�#i�y�{IE~�d���n��kD�z�N����9��s�6<����^�>1��ie��~�#r���o����~�½��`����Q/���hX B��]��Ζm�5�*1X2��]ӓ0z�Mv����ǁ���ygHJ�[K����ې2jx���i:�u�Q�� G��}1yT���B��j������r����V�3��^B�H)I�r:�ޯ����9�^���^���2�o ]�V��;K�S&�j����r��� �}Gl/T5�vfM�Y�&��M/(����}��c4/t�`�rۓ������ˎ`�H�K�(�gf�����*�ؘG�6��+��ܝw���FDV���o�7��=҈�&����#��u�Ц��퇴���Of�웙O�k̦u�����3ª2ɢ|#��n�z�nN��V�5l�$�2�kj��upX]�&�~�^�t�vVFxi����@��G����(�?M��vZ��IT��Βݩ��t\���;z��,�J�}`�m8�%3Q�� fT$�k����w��#��3��֍�4��}��\�Gܗ#�qB�ߓp��Qk؏���d���=)*�q(��i�?�%KLJ_�f��(K*�D�"���g�d�d��2�CޱF��l��"Q!kW�X�I(ZW�y�:��ew{ ��uZ�"Xr6�� R��W<�]wL)�>�'�PƁ��=!Ԝ�3��D�.���E�����͡��Nz�<�ALKP1����/n�Z_�m����<�f6� q�G�dI�� �.��X�^��NT�G���m�=�Y����!�$�e�����|�1W�4 ��<� l�< c�<i�a��R*�}��hL��.�ӥ���>����|a�*��n�Q�+�ϧ�"�_^�v���ծ:Ǎ��ê��5:�����'��P(����vè�#ϊ�p7��zQ�YǜS�5&�\���TA��^�$�9����G%T��x����x��ײ5�.���ؙ�I_��xw�WEA.��{ EI �����Y�*����"9��!梡���_Fm]ڈ �9�?��8�Q���fu�J��[��
Static task
static1
Behavioral task
behavioral1
Sample
61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe
Resource
win10v2004-20220310-en
General
-
Target
61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5
-
Size
2.5MB
-
MD5
ed08f49312feadd6690473e54ea2ebea
-
SHA1
3aac4c372c6fbef8370434ac97172ebd9f39e105
-
SHA256
61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5
-
SHA512
9817fdf570e9334f649ec908f2d223803d449e62ba9793d35af8ce658551c7136e4d76f55daa01d540bbb1c0a3d021cd2af339c0d8c31b810acad9f1daac218e
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
61363320425de4784c92e77c42fcd710526c3cbfefc21ac5119360f892e09cc5.exe windows x86
3152b8a45ff37604feee88f0b11479f6
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
gethostname
version
GetFileVersionInfoW
winmm
mciSendStringW
comctl32
ImageList_Create
mpr
WNetAddConnection2W
wininet
InternetCloseHandle
psapi
GetProcessMemoryInfo
iphlpapi
IcmpCreateFile
userenv
LoadUserProfileW
uxtheme
IsThemeActive
kernel32
GetVersionExW
SystemTimeToFileTime
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LockWindowUpdate
gdi32
GetTextExtentPoint32W
comdlg32
GetSaveFileNameW
advapi32
RegQueryValueExW
shell32
DragQueryPoint
ole32
GetRunningObjectTable
oleaut32
SafeArrayCreateVector
Exports
Exports
Sections
.text Size: - Virtual size: 567KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ