�ɩF&��ّI��~�\����A|I� ~noQ���e���D~���t����ډ����ҸX��~ɨ y�`�Ik�~��E�����#9Ť��Y�M�B�ݘ���N��Ȏ&�Y���7�5�]��h�噒�������E:xR���iiVʋ��bV��] �D)�3�z,��ܛ�@�*�q�|���f��3��gh�̗:��Ҕ�:��ւv�<�u%��Nj��F#�&���"쮪��l���XV&�M�d�${�|��α掘k��4,�ǀ���?��k�+J���^/�;�Wq�I�'�N��o�Z�����c����� ��L�n2�We��S\����L�;��ζ��p�T��r���G�<�3�J�@YYɡ��|�`���»�3<z5gAۨX8�N%��k!��cPXT��\ڠ��";-h1��%*�vD���'_�Oe��ٜ������,lx�u����09ӷ�Tv����ݰϙ�g*��O�����h�F.��̌X�a�S���8qe�S4)?�G�����pG���]�3�苆*®�HYxMyQ�� 8��Nfa��|!��`m ��ͱ���ه͡�ebeˮ���w��2���qq9�ߍ��3��Z3Vz#K��� ��fZ�g;$�v\A:�H5y�U �&�p$�~�V����DT�aL�u�k�+o.�&�����:�bu�����o'��gwh2�#��J���<�X����������}����UG��A�:��|��Qj�d����i��H���Ѕ���DW�R�Y�� M6��;���B��i�z��FX�\�v�e}��>�� ��k��OWI�a�?�;ʏ12����6p����t���� g9��!mv�[]��ݢ��P�$�ke�O�&\��I��̒!Fug�n��YO�n�G)íaݎ�oB?�ʷ g%] ���{���w��wg�3�X�6���&�w��iv�B.7U������.�"XR�Q9dsh��V�j��I��Yo�(�%P���O\¤}���l�|���9<�kR{3�6!K\ȬȈ��x&-�g�"<��l���[���h4:/�Z]qs:�,���r���77U����i��������\_���^L�hp$���φ-�Z"5_�SE��25mZ8S4�V��@�z���P2ܭ�����c��P[.�*[+�١���C�{t��8���*��^�Or�=n1 K��ݐ:Wf��{ ��M�}J$ۀԞ)_:�B͘���ʫ��S�{ ��UU��3����?Z�����ޭW=/<�?7/�1$�[��Ja�͵Fa��<Ͼ�-����RZ-]'z�Щ�� F�2���@���ag��c���6������+@�nlm�|!N�d�����*vE��˶�f����"=�� �6Q��x,�v/G[��v�>�Z���9#�1�����ȶ����[����g�c܌��J�'�ni�O�����=�e�#�aQØ��% NO�$����")OՏzC�II"�=���10h@���ۧ��23�r��f0���̳�ɪ����*0��b���P�������2+�7ܵ+;݈���� ��I0�[7k}g�_f,rCH���ȶ.\���8��[<?����l2@"%nKiq�������!�ԾQ�ni�g+J�����Y�V�Y�cP �K+7��.�t:)�KQ�l�������h|��̀��zb�sh��V�#�I�A�W3��d�XN��`�֦�F�,�@+�a܋ٽ���D����}���*gB��<��ގ��D�,�����U$��5� �EzI"�UAn��`{�G���JW߹a�̟����ce�@�oA��-��&W?� O�L5�_J�,؍���(�0�-L�t�F�:�ގ��J.Ԥ(�*�Cc �<������C���������7]��Gr��8��Pqt��4E&�M�h�V��tT)EԵ��r�%�A:�-�8��#=�"o��g>��p��e�h懓��$)�M��*�ޭ�"y���$�X}����5�r7�X����"��_M�4~+��Tc}C,����x�x}#Pe�7�v4��OK j�M0��>��B:H� ?�������x���m7Mq��="*��個|�gh� ��|�c����[=����ZN=�B��B�K���$et��5�g*�~h�^� ������Ξ��7���1bT,bS|��\ݶ���l�L������R�͗}Ƒ��[������Q���2Nj�>z)��� YG8�ϭ�<d��ή����8���}���4��9��Zc1 �����<W@(����z����"��*�#c��ڝ2�l{h�#Zm���/iM����Ui>��T�&�ʪ��O�Of?#��u��$�+�:.�865�����p3 �ଟ�Qd٣<���7��twWt���5�����Y!�Ӝ\n%���5jc�ie�b�o��-el�靌"�f����쌸���x���E��h��zf��,��,�|������uM�n���\���-39M�y���b����]�o�%$����br?�"�� }�ى\j#&��1ʾo� R�+������b�C�?� ����6Wf'+M0��"�5B>v���WLв���s�>Y� {����m���� ��-Ӳ �XY2��}��~�C�����p��`�M<]��h�ͱ�&�<B|�@)!М��mo�n�i����a}�N���U4�E[��*(����О �����|&N�@�)ua��7��ss��_�.E�������B�U+8-�����)��64,aSvd�!ɖ�3��{�t&{f����������]��#�Ҙ�}e�i�J��/Å�$������,ZU脣���X������/�`H�'��J���O���<�S�����v(H~pqZ8��:vϊ��-ev��C4��Ҩ�b'��]c7g�l���t���]i��0Ix�I�4|�C�W~�]$ v�\҃D�3�^��'CJ���O+�@��&i2����J�5ǾT�ܘ9����,g��"H�<�ZZ�� �����߈<�l��v��WN�
Behavioral task
behavioral1
Sample
42fb30d30edd2a0b2708a3964f37ccd00612302fe8943a5001999c3282415379.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
42fb30d30edd2a0b2708a3964f37ccd00612302fe8943a5001999c3282415379.exe
Resource
win10v2004-20220901-en
General
-
Target
42fb30d30edd2a0b2708a3964f37ccd00612302fe8943a5001999c3282415379
-
Size
1.4MB
-
MD5
00a96b6edb132485679ef51b920d2660
-
SHA1
4e1f0156db1fccbb31b5120980bbfb230a54e6a4
-
SHA256
42fb30d30edd2a0b2708a3964f37ccd00612302fe8943a5001999c3282415379
-
SHA512
2649e3f75e6907ebd92e01c552e03bf0558d9cbf6656218e459891c360dbb37fc4a96d9f06a6ed3117739b2ddd0867bf1a74e69b8fc9c96a7247425098bc5488
-
SSDEEP
24576:Cxko5Yi69EJFkMzOXVNHPpSLqa7G6ssHej7knfYqDe2uSyy7PakL7bvVjusUOC:Ixn69EhinPMLqafss+j7knfpe27y6PZU
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
42fb30d30edd2a0b2708a3964f37ccd00612302fe8943a5001999c3282415379.exe windows x86
6b2309bbce686bbf891e73a50f8f3c65
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamClose
ws2_32
inet_ntoa
kernel32
GetVersionExA
GetVersion
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetKeyState
gdi32
GetTextExtentPoint32A
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 884KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ