;-Wp\�XH�"b��E̊���H����n�|��P�.G�n�-�ht U&c�]�՜#]�����䩥t z�+v��]%�8"#���Oڈ����U$�����d���w�`��0M�� a;�h��B݉������\cjz>�Jɽ&��� �ij���*ߤm>:�[9��U�z@��u�����:�f�r �q_�E�ٓ$%����b��D���v�z�і+p^��~d���g�1{��gS&��ʯ� �I�(N���$���ɬ�Ryh��A���z���q>��Oh�nt���}�aЫy/;a�'._� ��_�ͤI�d�ܦ���7;e����_*C,�\���hn��c5u�u�r�? d"Jߢ�����=�ZWjNP�}��IJX��2X������W���I,~�7%��k�P�����G��!���|�}�i}�?�m��JЊ A��kvC����dA������l��q��J����^rw��{�� �ȴU| ZY2��}[���g�˞7��f+)������e�!9Y��Th@���A�0�BH����g!��Qum%�%k�V9C�����9����=x���&�P%�~~F]0�J�4�����BO�h�mFN�gɻ#1�����rݪ���mg���uJ������5�x.p�4�1j���%`��,����G���K�D�G�U-c;x��ƌD��l% R�4[d_�&��#����֟'�2��B �����:gm!�5m�V�����n�v��4�S�NH��su�K� @`����$�0�TW�� n���l(][��Xg�[�OD���@u�ص�� M���� �] ��.����s1��h(Ƙ�H��m��f ��$r�؟�[�)Y �?X�^��.��QO|�m���fm�'�)�l5ȱy��f������?��+2��o��9���e:Q5����.��y�]��%��l�B5o����k� �����z3����(A��)�.e�;z�./���-���Rjag�${�"�}~��`�]j�Ao��a���"�#Jk�c�f�s0o��d� ��:s� f�V���^��$�9��cؔ�x^�,���sDV���N�n���Rx�_�v��yk�c�v<;X�ҍ�b�pP�ޓ��(��ƀ�l(v��.����2��c�������u�[�+ 5��7`�*��5o�������=~N1'q����t݂r�vZ����^'v�INU{�/?� �9��c�����Hg�{[�HD���Bt�1��ͷ���v�|���:�%�Sb��L�i�0I�p����C3�� ��ho/[>��"vT���ե�J-��#��#��ڣ8�~|`.�T�e� 7@���:����v��qc��01�)������a�N7�L�M�S�#��D����V���Q9���qH�]�u��2y�����r7�0����DM������2�!�]�!(�����w�d>TW4���ry#���#�#��Cj��k4\'~�� ��ݳ:�&�ikz6��%�k��T���R��w�������fE�j�+�#wcaV�:��d�U��$i��`*T7M�% '3<�!>������_������8�o�S���/HY�j�-���z��q�N�1�I^b��! xÝ�7y^��C��H?���I ����E�Vh�8�@\�f���o}���W'悬ނ�&1��>� e���T��a���`mTRcp1�I¤��J���^��Q��ܩЈ1�#ߌ�������}���`,@*���;�L�҃Y���9�+S��x�|�T���V����3���Jp�A���������iPJ�(��>feӅ�����; ������%(��B�k��o�>�xs<j��Ƥ� ﮞ�B�`�+;��n�M;*uA�ӻ�M��ߵ����� ���GBbN#_����$�뼖2r �eNJ���c�<��̭?�Z�IE[��� tf�b!�{��BQ�>���Sb�73k��h�F�0+��r��p �-[� K�1�tA����z�D4vM�&��W��&���kit'�-/���Ͻ�,��D����cKRY�M�������#���ʑ�����14��p�7� �R8���g)�A�@�j��/l�r����&4.8��&�zu�9��//�n�+j�������J�� d��m��RtF����Vч��0��*�Bbo�>��*��eX�O��q��ʍ!�Rz��r�TW��z�����5�Q���KeQ�5GP�������uc��Cq��oђM��F03q�V���Mڿ}����p©�{gN ,�j���rz��1�ּs�����s\����]�h�(�4�/Ӣ|X�z�:��`�,3+�>90��%�?$/*=��5���_~d�?_L��p\��/��GGqf�hP�fCU��PO�8=Mm���Y���aU|{���"L����l�0bB��e��or�4��=����Z�x�=��y�.Yu���Y�HTrw���&p�U��3W�����ݰx�lS�k��ˮT���.���SVr偘�{zڽ���({������������ZKY�IOp�ʄ��}Up���p���o��s�.o8}?��U� 1�_��E^C�p�[@�k���8�Ѫ��L�#AC=I��=JG���h_���;Lզ;Xyȳ��D��}�O��Ͼ )���� �?�6G��m�}���By^������|�$����]�5�LY���}��V����z�@���]C^Nv�K,b�Pb��*�~^��J���9�~JA[�R����:I��v����d���Q�h�sܸ�;�>�Y�2�mVl�t��<�8�oS7�xn�ⶽ1S�?�*jm�ɰ)�g�;�Z�>���[W�l��k{�)��q��d9UM.d4�\0����� �A�&�� P`�1-���?��Ha�+����IR�hpI� �f��P��3��R����~��,�$V��K�v>'�A�IPn4����A�{JG���Y�H�6C��q�C�䔋�0�F�ƌ�ܙ�I�7�������O��P���?
Behavioral task
behavioral1
Sample
58c69a35991347e174f2ddcb5c25d74c288dbd98212478c4983c0dbc1cce0f52.exe
Resource
win7-20220718-en
General
-
Target
58c69a35991347e174f2ddcb5c25d74c288dbd98212478c4983c0dbc1cce0f52
-
Size
5.6MB
-
MD5
80a0a3da2f9717c0532cc760b1e7f746
-
SHA1
999e1bd2c3947f898d21572c2c360de72232ef09
-
SHA256
58c69a35991347e174f2ddcb5c25d74c288dbd98212478c4983c0dbc1cce0f52
-
SHA512
4edcea03f46ae0ef3b196f69d3ce7ad6a9a6c7d73a21c833cc60c6293ac943c070cda5ad8d7b613a8100e8b1aebbdc7326cce8790db83e40a3f2a3d7013387b5
-
SSDEEP
98304:b3CYqCAi0vhV7ZTOOVQlQd5//jYh4iCik427u8LOIVBnus2DGbltF:bChV7ZKO62d5/LYh4PlHjq03F
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
58c69a35991347e174f2ddcb5c25d74c288dbd98212478c4983c0dbc1cce0f52.exe windows x86
3412201c1d2e5739d0131ee567f107c1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RaiseException
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
OleInitialize
oleaut32
VariantInit
mscoree
CorBindToRuntimeEx
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ