�P�k��[bֶ����_F��Y����\��&UG��ji8��.dۤ"P������c'����AG��a����6Z��l�����s�(���G�ZM��)��w���0�?i*��b�Gq�����:��@���3������h葏��vq������rs1����"������+���{Ew����6-.9ۖ�a0��^|����C�����8�q�0,w�����R���?�m0���խ�y8A�n���:mv���ύ-�@@?l������ � \���� #���x��'y� �D�����X�Rc��R�n�YFWM!CI��"R��Hy�=>�z��0)x�tξ4}��H�N"����Z0����B=��� ZsA��Uc/�#��� �$ˬL���ܫ�t��&�ݏ�J�C�m,�}��RLr1b�7���_#ٛ���*�u��a�t��sḚ̈���a�bIDsə��eG@��v��E:��{n�鹯��T!����D8W=��I� �Sz�T��� �� 6O�7b.��YZ����=)�,ˣ��������dr�3��f9�33���ѕ�q�BJ�nQ�gch� zq �λ����V�?�s�G�������n��e�ep���&i���M��M�O>� ? ؖ�(i!��{� %=N�47Z��"2)-�(�½䳊L���w)XO��L��Ru�#D0{&�;���K�ejBy�;��ꆇ��җ6�|R A�[���%���il�ӓ,�ĪMc�Ȓ�e5�FL�x���ң$'7+_�Wi�rf�&��/xx��H�>)��y��W�qI�l!T$&r������/�&�?�zU�h7*�9�0�?��Fy��ّ�d\(�c }Y�����I}m?N��#�v�c�N[v���*���@b�PB��)l��s�F8#n���#ڣ��r���_����P����0�ɑ&�i�ZR�*.�==cҍ�,��D�����a�-��� q�P�:�Hg�v�����������+�b��~ ��T���gt�a����}?����T��N��դ��ŋ��t6�b���q!#��ò�ܶi*�Ã�YPF���'D&����C/�r��]��-{&pM��m���^F������}�b=�V44o Ɇ��� 7�S���td�m7���^��Kp4�oZ���:�7��ʿ8[�q�����w�Bc��3e�^������9B��wq3Fr!�8Q5���K�h����E�/A�&%ɹͬ&��?4�zc��M;j)-�ȣǽ�N,m�ٍ�ۣlP�X��|R@z��A�>!9/�6N�6�{\��W����n����#T��J��i��&��Z�n�EIK�A��9�R���Œ�j�N��\��/�$�UcXe�/��g]�E�E>�.�h/<[X|�u�fgJ���G�҉��:�T������~s q��dž ���VQ�!��U�2�S۴�,����65�ki�n��_�������s#.L�Td�K�k�g3�[�-���E���@=���y.�'�W� �|�/����[c��Cc�S��1��A:����Dw�l��D/I�6�+�Oō�#K�I��2��(J�+����8;g`\ԋ$�Z!I=��u���� ����8�:곇B��#\"f`���2�T�u{ a'6����yQ�i}�W�D=�cs�l�/;*�v�͋[N%[��:�[1�F���ܬ1��|���_H)cE=T�W����� T'����KS��j������פܛ�uѪ�<tnb 7%�d�M*ҿ�%���W\�z���Ż�^�?�ÿ���/�x����� �g�b3G��K`m��.�/T*>���y�$���n��߱��~(6��� ��K���D���jI�D�e�2B���&��K5U3��'���m�u �W2{z�j�u�*�LW�w=��/�Z$���_�k\ՖcX�ׁȕC*�5��դX�s=��x����78Z��KZ�����;�~Vey���wҋ+�~���t�#��Թ�%��pwgC/���?�V��tm��ch]H�/Lp}X9��LF���r"f�P��f:�&U}V5kB�E|��\�ڀ&����I��WL�h��u,�Q[cpa��*�����"'�v9�y`>� �32��*���*��Dvl�Β���yT�i*�Bv�o�ҜI�B�>"D:,Tl#Y⠁Ͱ�\�F?���Ւ�|E��.�G&�^��w(�n�pa�V*��Ã�ݹA����E>�IvC�9Jo�����,�ǐmyW���Zt�j����2�f�WV@*1WXѣ��@��E]�G��E�tW31-��A]ȥ�Ii�o8̥ߍ2����xQ1[�ΘQvl�f����.�i�'r�;G2p�`����DP��#��N�O�C�Np���Jc�)����t���$'�i�V@�<����tz����?��q�lsr�[N�^Ni�5�z���|��x�P��ϯ��Ljs4 �q�Ζ <@��D[ �����;k�p�k��X���y@m ��Vp��I�b��v�Dj�0���j!TGL��7�(XoR��u�`&+.�Y>eAv�"6����y� @���s)������0Nk�2Ɗ���lA�T|�p�6��حyM.���tH�(x��w�_�������ஃ3.�0"6sc�|J*�'���������~`l&�'K����^Z}�=�p��^y���};O��9��"��!��� �2� pn\�E�����V�SN+�&�%���]��wWE;�Zq�A� Za����?\���K� x����`#���%�dr��ᯇkX������*y�� �� O��:I��CR�E��ǟ�j�nP�S�i Y ��Y�y��5/\���o������6�"|>)-�,��s�Fn�y3���ah; �j�:(�#���AiO�S"���AZ6h�����7_z!bcj���ʄ-�jGO@��,���*�<�����ٚ$4��3B��M�g�� <9Uv܀8���N�-t���ӉҾ��`���.��p��i�pX�O�,_[2X1�{Q���-�ֱpl��R�ۓݬmA�%��3�5��
Behavioral task
behavioral1
Sample
vape light.exe
Resource
win10v2004-20220901-en
General
-
Target
vape light.exe
-
Size
5.7MB
-
MD5
201fefbe07e459a7f7c62f75c4e604d3
-
SHA1
c1818418d6a9ec34533b98435d3716c30d6a4380
-
SHA256
dc33f3e25ecf36f710d55440ff86edb9901d6d39619ee32ad956435871a9299d
-
SHA512
1e2c315e2717f21eb225f5befbee7d4ba48114d8d97e687839bd6f1cc189cf5bdfa50a910df60e37b118aad6bcd426ade6b5be56b3c7286e26a98cef0679c7ce
-
SSDEEP
98304:DFU7Mx8BsmNbBFDJyiZuym3gLpj5v0k6MspZQRiwTLzmdF2FlOS0FuA:DEMabNtFDciZm4b0nX4zm2FlJ0Q
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
vape light.exe.exe windows x86
fde08c2ece9a577858ca3efac88af12a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetKeyboardLayoutList
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
SelectObject
advapi32
RegGetValueA
shell32
SHGetFolderPathA
ws2_32
WSAGetLastError
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 507KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ