�D]ʍ���tdy������]P�T�n69*{���N���P���d@�!U k��V��5��F�Uᇎ�[Ǣ�:p�W%� �j@�V�ΫF� �0u���Z�TS4��{�F��Y�Z�����OB���6�.�a���������Lý Dr��1���}}��1���|�f�BԶ�Φ�"�y6 �.H���1�L��"���yCg�ݱ����LS�2������zQ��#풄�:���~�VQ�ֲ��?�&�����!�05����1�<�lq� �H���/P� � ���Z#���0�����V�����&AW��J�b�*+E���7�$K�+����鏼P������ �C��5���og���xir�Q�x�.�����2A]��H;W�]t��M��GD���$%��?6��m=� NX���.z���*ʬ�-��Q�} c��|myK �o�a�����'�ҿ�;���ig��$��@}l���} �ufZ��Z}�2iY���I�h}�b�߬c���~�j�i�R���`V���LP�w������v0�m�ϋޏ �� T$~'�\���SP<nVGMp�ݝjW+����MćqM�M��`�S-*�?�ivO[c!�(`s�g-9����&�赳��ߐ��!�E�)2��{����:�b-�WH�����1�QlE�,��%06�����`Ni�c�i�����{ Ҷ|D��GV�����*R����}M{O�ĀLB�$��*�5�g�E�ˀ����|�2W2ti�H�������ן��`��%�wt���4:�Gi<��`��\�gG{> kJ� �&�[T5 �u�'���j�J����*%Y4���,j�fB(���x�w���]9;��&E�ʵ�� �9� �gع�i��U���o���2La}�3A�� d�c�sutn7��QB}�'�<���t�]N�������Ǟ8n"Oi5 �P���;�EwV�~]��MaF�uz��:t=J11<�4�}E,%Ȫ�Ƶ��Rt+��#�.P���v��������~�o�S���2Yk)���8��<R��&��9�*ga���1� 9p6������y��+��ձ!��K� ж��DbI=bͩw ���v������b1�x��r�w� ����$ 2/�Π������i�|.����C��G٨�J?_�A{�C(�Gf�����`���8}�L����c�d<���-�c]<��B �'2Uʙ�t,h�����OU��/E\.Ln�7�,:�a��Py�E�8P��g�f����nս쭺'b������-�CV��&��i�>�rND����g֘�a)a����YN\V��3(IĽ�T��3�X�W_��a X���Е'n?[�a5k�h��%��A������*��Sj#��� ��\��H� �)��xNK��w����V.G���_�V�!v\�bgh ��T5I|�5e� Ŝ�JM0*���ɽ.�y�mmq6���s���P�NҎ�༖f+!�2�QIc�7������q�����Q�C�g���w�Iu��4J�Q�Ì��8G����mak}L����v�hdṘ�����M9o9���@��4�z�~�n�8�jC�6���E �O�+2��ɻ������J{PL�+�����{m"5��R���}��(�c�O)�)��ǹ�hn�O�^x�Y��n��m)NM?'Q g�7b�h����9@���oK(˻i{{�z��z�꾴��3��`3����?����^���+����@?����NxTP#A�d|�턍J��@uN&ȧ�>wl��|����FD��X��V�I)�{L~~e�_�+��9�j��mcwR�Ңo�n��T�F�����T+d�=��$�&a���R+� S��a�玵��Auk^$�_P岎',�Ww�EQ��t'?V��V�!��4��k.I��ٸ��MP�|�0���rv��ڧ[��� x�s��;�D���� PǨ �@�t�� f%�h�V��m[1�W"�y2����:م7����M�^흈�Sƌ�7 �mئ�r]���B�o����nQ�e�0��y_�������{����!bi��<ș���� u�� ����o�&��xB��oE��>~��~���uQw��'�@=���3��e��`���őWɖ-AJ�%����2��)<x���w��y��c7�>Ӗ��[�{��H�Mx��\�&P�3����B[Ҫ��J�q@�Y��ߊ�FvBV���.<Ip���p�?)" ���Q�f�`���=X��I�'�8�7�n���ԙ��.�]Q��q�XW?�}�)���ެ8��+Y'5ֽ�H��A^���)�"{�\M�G�D���9�� A�qJi�5��M��U?����~��:l�3�rܡ4K��Ar�a�'�b��~�Q��*Fh�cC- ����AWe`����pjtN���UaH�hE���訡�K��|5#�V� CP.�Oh�0���{T8!W���*9��Z�\#=�����o����7�2��Z�`�Zߖܻ�QȈ�g���y����H_��<���RKn���p��Ӫ��R���#?�G:�H��Z����&G�^F+$��H?��⧛���j'��(I�5�|e �L�m4~��ǃ��@�I�15���C�r��@�vS2|!�@ҮC=� ����&�����ǻX�����ĞМ��ኦ� ���� �i�[�di��V:�Mi������]٩��O [���o��~;��yUG��tĕ� J��N�Q�LK#Z���<��U��z��4�m�`����+�Ǥ��}����5:LJ�a7�)�����C���E�s�ȝe{�#���tQV��#:[*�Zx9u`�+�8��ZOA���~/k�� �/�a�y>,G}�6���a^���U��]~�h���=���D�=F������U�5-���v/ձ�[�\�������z�_P�˩`�Ժ��&��i�~�� � �jjU]Ű/�;��a]����y5�T�� 9FsA��Bƕ�Գ�$)�B] A@�_�I�Mt��t�gV�xd1����EB����<�O�e��v�Z�����J���|�
Static task
static1
Behavioral task
behavioral1
Sample
1f782c00f48835beffd1cb068c1b43854b5f1542966dd5926589fece4a5058b3.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1f782c00f48835beffd1cb068c1b43854b5f1542966dd5926589fece4a5058b3.exe
Resource
win10v2004-20220414-en
General
-
Target
1f782c00f48835beffd1cb068c1b43854b5f1542966dd5926589fece4a5058b3
-
Size
5.4MB
-
MD5
c82a4f52bf0cac24d01281f5b45cd350
-
SHA1
2884f66d660f20fcdd8680365599aa1e41481cb3
-
SHA256
1f782c00f48835beffd1cb068c1b43854b5f1542966dd5926589fece4a5058b3
-
SHA512
e1ca8887cb3f5935ffd2c77e456014011b8c874f6e007e6e68579b7a6810875875c9a2b842ec0aef1a8c2d57ec1cef356eb911e2335e0de14b92cf3c5a6e3ad0
-
SSDEEP
98304:2kOEPeFHNTH5zKO7zfAysN+K34AZ+56eQGhZEf7qKBnzO6:2kupNrUO77elO6eQGMDz
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
1f782c00f48835beffd1cb068c1b43854b5f1542966dd5926589fece4a5058b3.exe windows x86
e8ff7278bfd2b1e46a6de0bbc31b640c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ws2_32
WSAGetLastError
kernel32
ExitProcess
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ