0�0a*|�ˠ-wb��b/��|�/bv�f�@�MX��UĂ��9(M��Lma��m��r���nTn<m�*��O�ޫ�՛v\W��22"��&�L5��LZ'P�f�Dr�VL"r���Ȋ�8�* :v~5�O��*��.�U���������d+���6qh۷A�g��-pJ��Bsȝ�f��-+($�#�f`��W��[Ԁ �DzI�X�}]<P�C�oW �1w�͕��n���ͣh.��#�f�����5+8BU��!Pg��q���e��{�Y@���~�x%E�*�' �����/hw������M'*�Q㈾D<9������hoܻ�g�����̩*����P��-3�<B����Ӻ�gw[��&ug�����h�(��eE�d˼M1�7z��S�~��H����C�L���j�R!T�]G�/O��R@A4 ���z�91��m�����U�O&y��kf�RG0}�?3���������e$d�V�H^��H��������>��%'s�B&�d@��n@�����$����+�c�"� �A��g�ʝP��%�\_O�]��ؚ��[�e��F�����ȁ�w}+#�=���0C1#gѝ��Pk&�D���](��Km���\��H�-�ʆy�ʕs2ͽ��_{D͏��� w�p_�W/¥B#TP���c-��UJ؝S ���yx/�;ҞҰ�gP^����.��l����V��O��Z�qe:2PRFt�9���}���|,�kIw���������l?�D�����c��D^�[�cc�Xdܫ �]���F��r�\e4���/O����g��*�V�(���Y�WT�-�&��o{4�Cax E2t���Y��L�`���� �%��N��U琄�n�4H ��)������`i�z�ZL(Jf����/��M}=9`����+������!+]Ì�槾D}��r�+�C\q�nȺ��Q���*O!EEŰ(w=�h��o��Β)�õ�G����˔���"�F��TX�����]�ވ�mi���]��Y�j�?��������2�����z]�H���G6�_ܸ����hLh�.?D�����Ie�D�����N�biBE�cG#(�ב(�^�BM ��Bpw�0�l���U&��� ��2�%��@;6��O��ԭ���3�c�$�DeB�*��sd��w[`}Z,��P���d.������f���}qw��2j�E>�n1�a_Ot3=�doUZb�� MIW�x�)�Xvp��C�.3OUZ�z}T⧳�7~w- Y�����6�,���x�r��==� 3��e�e����l��F�c����T28��˱�&��m�&\H�rj�_�b )zb��x�vK��J�ly��5�6�D�Wڣ�+���]�/<���s��,��v_��y��O�jT�u ��u��\�� �h�X�Ȕ�:���ġjW�v���Z���@�BD� ?f=�1�h�Cn�0v5ѷ�]�����=�;&�ޅ��Dw�t����i�����>���@8ᕂD�v���\���zd��9��C�z��� 2:�2�畹���?u���/�#���Ѭ�+�_:^G��p~�} /�e����� ��$�p�\4��E��5�#t�́ݢg��Z��gv$�Y��5�ۄ,ML_1kl���њǑ���� �z�T1J�j68 �s��ȃZ��oɬh7��ՀM,_�#��W�%�IvAr��GsB�(����P�(�,H���Ӑ�8�w�"�`���5)��:M'�Xnk�mRsH��\5";[Xj��7��n�#�� �`��A��.TfC�r�4�����5�����:?7�KK�6���!��u�K�2�.(�+�����������(Z�������c���5���7#I��:t_�t&�t���<��z�:ˍ{�_���[Mw�H?�Nٲ��r�2�(���m:�d�]v*�f��c��}lu�{]��\��r�U��F�% ��լ0h [�.�}�0 4�I��~��wL�b��Ǐ"?���1��m���f;���Ƕg�ȩ������B��V�T��u���vt�&��5���#�C��0�AZ�Ү��$��Z�YH3�9i&KJ�y�{oذ����+ �aWe�īm<���\�+�κZY#� k\- ���d�f��?���D���#ćՊt�%p��:�{��f��>,������Vz���ȇ���%L�rsH#a�#H��1����~�M�B��2^(�f6�G��`��@��~UP���~\�Ѽ�c�T��9Z�v���Y�h���{�6@����s,��t�ZK�yO+SէQ����6\��0?S���/��nn6R��!S�h<]I7ER��V<y,��1���H�f\7B"�`��{�&5[�OU�"sg�H&���"��N����E��SuCegӣ�]&��ms��I��ίzr�_ң!�T�b1@�-_� ��gtvq=�J���M{�Y�%`�J�����;���[)���^Av�/�X�G��� �y9`�֭B�O�z�ƽ���Y����Z�l#eҟ�vƈl�^K�(k��s]����*i��멚���F���W��_�DR��_��/|l՛I�m���m,a�d��\ �!�o��`�U�����XT4��7� ώ�#�Z^a��d���6�c�tL����"9V�!{�OOF�i鏽��.igw�&k�'�~�,a������B�e���'�JX���sJ�f4�oo��f^��0g&\�ډH��:�X�;i�Lhtd�/��Eo�(a.E��[�@A�?C��N˫�\j(��cvۆ��q�Z���o��3w�E��U�Iʟ�*L8wK&�G�@��z.h�����H����Z�D^snf�^���3tW!}5V��v��(-e?�cg~�T6+�s��?�`�r���n�O��n.Qi�{#W�3�)uo���敀D^}8q����"�bj}����Afj�_^�X-M���N9���Ŀ�q/T������Γ������s�5�/ �b�d�ܗ�r��⏟ ��-��,�(K�J�h�(3�7�G7��U��Y� �������C�f��y���d���@��V���c
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
36b479ded61740bb4c479a7969d5d1e469173fe50d4378074f14d5c0fb52d3bc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
36b479ded61740bb4c479a7969d5d1e469173fe50d4378074f14d5c0fb52d3bc.exe
Resource
win10v2004-20220414-en
General
-
Target
36b479ded61740bb4c479a7969d5d1e469173fe50d4378074f14d5c0fb52d3bc
-
Size
1.1MB
-
MD5
42d6eb88c4a77bd128d3dc9c0e4803d0
-
SHA1
622ed276c5e468886f2a971c0322092b0f9256af
-
SHA256
36b479ded61740bb4c479a7969d5d1e469173fe50d4378074f14d5c0fb52d3bc
-
SHA512
db40be563b4a476b7c7a34d599bdb3e53ed0f7688fd799b5066913e26cd7f935b95478de43c1c853d3c3e95f8f27e74180713b08b4b7fe93dc86950fe3b1e587
-
SSDEEP
24576:qpR6TA4JuF2/YtcV++iel5FJw3gAcZGLUyTvUZQiZ9Jvf+5:bNuOMNTvUZQiF+
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
36b479ded61740bb4c479a7969d5d1e469173fe50d4378074f14d5c0fb52d3bc.exe windows x86
f14bfd5563b653bc4f494499bc582bf3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStringTypeA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ShowWindow
Exports
Exports
Sections
.text Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 926KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ