�|����8R����kD�4Q$�ʒ'�:5h��v,��p���̌�>>�|��땚4�9�����M�Z�8���X��f �W���J."��$sf�J� �m�z����.�"���E�P}�_��p!��˖O�.v�2���H�]��^=�J$�Yҽ?Δ �>��*7(���N���XR\������Ԛ�4x?�^f��I4<�**C�9�<7[rƃ9�$;�+!z�6��-��n<FAs쫦�.�@���ͼ��D �˪N|�*�b+$��x@ ��/�<�y���� �t�;�{1�8�b�>Q/���ĉ1���U�����'��e� �Ζ_��119 ڍ�� ��j�� Y�q8F âJ�ed�N������8SF�O��������C�������\�C���O�}E��AN�+�u�~wށо�Z����9~$\iK��3K `Oe�tzj��j"l9���^ ^O��}�o4b�Mj1�O8����#a0 �/";�:3U���$�1=k�lEF��m���(���J8�[�SfG�!7� ���TYm`[�g����v�챒�n߄YJ�V�cr�y�����;��F�����A� ���Y�q]S�*.J�,��4�=ӛ��� ����#���� ���Ɯb�.\��<�y��L�;8S�Y���{���}�N�Zw𦟫E�@�w W�G�FBڣ�DR�+�����w�m�<���Z����Ј`�x��O�G��R^�KaS��#��蹸T�r��R�M]%eS��~���L�֙o9K�� �� ���F+��fezi��E��,���lH�Q����X��'�3����?��� E^��e�B�Q_��e��=���#�m�+O7Ih1}�+i�zL-��� ����Zs>�Ad�ieE`��X˵A�,�0���d):U�:���"Wu�g��ֿ����]!��0ХS���h�}���tX��H8Fy�������w��j�|��oh�~"��bk'cL���*���Pij`�LS3��t��,�O�.����W��t)���٤<@����0���,v��T�?�#8>��+A�{s:�8�G�B�0�#ù���엋b�������n'E���0���7g�_���2�] � ����ԙ���inx|v�8��Mrջ��:�x�^!��?�?wѭ=���0x�͌���(XVuP2#{��o����p(���k�6Z����uH����{�0X+M�+p���7\�����)�2̦��g��fѩ+���N����eq�j�_%��ey�u�^�M�����YIg�ظw�W��;��k�É�V��0`�-���@�lY����˸f4Y>TJxۺŴ�g^}�rK�͠-� �x�����v2S�p3o�{�(M��-�u�w>����Ǹ���^�C��m����R� �a5Ѹ��`�����9f��#ٝ���V�^�rk��,r�l)�׳���������s��.3�ѹ ����'��!��߄](�lK�u�68T�Us`��Շk�Q�������s=V 9=r�~����䷬�(`����i&�Χ� n���m�Ԉ�l\��52'����ڰ�<�"�ͧ0��-������0��n �+��Rڍ�5��g���E�B%��h�2M���妜(:���UT���Z�~�J���F�8u�q:�Als\˔� ^P{JC��kV�i����~k��(=���_)�ԺP��`�ҼgI�E�����ǜ���`���C�����fC��[�� 4�P���6JϤ���d�2��d��6�,�K���<�%����Ql՞a�/胃^,���L}v7���Ơ/�V�)L �Q� ���D��DY��\����0 ̧;���c ������0�!&H��;��Wr�@r5 z���J(�~Y���9#��O����?�%�R|�a�+����eF[��P�dV�h�8�(�5\��Iκ�/��?e��Hۥ\a���bh�f��%��lg9�W�U@v�7=����*i¯�%�nX�d���߶x��KOq E�v�����Wm �d!��?�WmN�劇l+m�T&����k�n�~�MIe� �=Eޝ'�P�j��3ۈ������1�1_�)����3��W_�^]�G}���U���ȁ"����:�d�ߑv��'�������������o�Ms�\����&��I��5�G�T�y���}0-���O�6�g�9�p�)���b����X�;`�PC#2'{\�K=��Z�&���Kt��������#!���]����Q�������|"�.ɨ.�&@�"<�,*+�3�b����c�S��}v��+�*�Ɇ�@��L<Kl-/hTͧ5�,S!n���K��_�I0�a�b�%�D��ʈ��F'�����ˮA⎿�<{��>��mr�P3��U�FU���zm��� ���a5�R�a�<$&E�"I�2��*:�ig7��3���b01�r8!!������6�4H R�B�P�k���ݽ�Pl9_�C�����J��8�!R�Hk�'�y�9 �V��'�Ꚃٕ�g)�����������=�':�Q"���\�_�g�'�q_[�0V1�,��q��}���"�3� ���{ʪ�����������"��s��_܌[�;+�4L�Rk�b%L��@:l���^s�ڴ�R����)�x�:'�X�P@��+~-�d��yL{[d��/�"Q�#ɖ��=O�x�4�f꽄�~!OVS�n��G����㧗Gg�6��cb��_}Bl�ђh���E�J�@Q|�K��>�j�q9���xMT> ;F�]�����@�+v�������(�/.�j���(�U=(��$>���@��&���堪ރ���E��m��yx= � �@��f9p 5���A��?N=B5�(gٸ_����kbK��� ��j� M�V��+�����E}�'$U��!����6�:~z�C����:�ԫ�z#'��*d�g� ,�W�t�,�S#v 醨�d3}�u���QL�2C�lg���� b�c�k��1f�,�D,�
Static task
static1
Behavioral task
behavioral1
Sample
e93cb5fe929c88252bbcb1ae8d73bfc6.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
e93cb5fe929c88252bbcb1ae8d73bfc6.exe
Resource
win10v2004-20220414-en
General
-
Target
e93cb5fe929c88252bbcb1ae8d73bfc6
-
Size
5.9MB
-
MD5
e93cb5fe929c88252bbcb1ae8d73bfc6
-
SHA1
81f04e51bf83c1f9d45f333da4cf13167a89fd43
-
SHA256
32b33877baade9ad5e8fb751c6a6b4ba6176ea7699732bd5ebd2af161728ac1e
-
SHA512
4453b7f9bd989fc34816d7d8292463b0df79eeac11919d391a5695ecc76b28c97f06415768365b7af9404d733addfad7cfa9275d583452216ad398938719bc9a
-
SSDEEP
98304:UHf4uq3MUO/7x/LCb7cGXMkds18GB5LolbKgtFrA1k9JZ+4olatna1ohsc5k34j1:UHo3zO7x/LCb778kPGBp7gtFU2n+6S5k
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
e93cb5fe929c88252bbcb1ae8d73bfc6.exe windows x86
6642666e5d6a19864ba6f5d903247122
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryPerformanceFrequency
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadCursorA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateRectRgn
shell32
ShellExecuteA
ole32
CoCreateInstance
oleaut32
VariantInit
imm32
ImmReleaseContext
dwmapi
DwmGetColorizationColor
msvcp140
?_Xlength_error@std@@YAXPBD@Z
wininet
InternetReadFile
d3d9
Direct3DCreate9
vcruntime140
memmove
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_libm_sse2_sqrt_precise
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 831KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 687KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ