E6�{q��};� 7A�G��<G�m����zV˘7�t��2��}�+��O���AF���<%�K� c����a5�Q�Fo��D��O��� x����Aۦ3��S��?�^� �Ts��,OK��G�$�0�U��E)\6��ny�V.1T ^E�4̩N��:�m�We�ޚ����2��Ԏt��-%$n��3ׄ�>}g��������IBk�a�(��Ƣ�V[|sWC�]^Ĕ�4��j�0�5�*���xIJ\N!��Y�R{���ڣ�����n( {0�$A����I�Z���d �^�o��Q�،k�v��k������|m��������F��߳�YFK9ibn��8-E�!gMO"� ��������������+�����Ǹ��9�^=o"�2�;����Itq����s����1E��oP�Z��ҷ|���d ��Nr�K���-*�/A�*�1�����B7�p�<FrI����楬���~�a���]�����}��N[�Z�ˇ�%�Cz�E�dh�����>c ;0��ټ� %ȓ�Lچ!� �bH���%��<(3���WTf�����.!���>#�lN���+X�j����s(������8��`��ᨡx����Q�I$��Bo�=xQ�]=�k�����M|�<?0�K�"�ռ=?�E�P���h�ȪQ�R�ջ~�x��7�d:�i=������]�v�"GU^b*��E��#�ZO[����/sx���&g�����5Z"� 4��q)���:��s���-�e߰������1����ȝv���� ����z�ͯ���4F�Y(��0�l�.�:�ὗ c���%�<�c*��C7�[7}�_���?;�QS����[��P1Ri�������X)�%������!Q�]���'Cə14bWntT.���}nhv����&�s�̭%��ÿ��]8C�1L�M�����}�ᫌs���(�Y�i�O�����������_�ē�9hfYn�?V#�M��uN�r-ܘC� �7��݊,S9tŜxf3Z��ZȞ�����EP��u�W�SnO%�}x ۾���=�] v�HM�?ds�� K�E�n�}��Μ��4.�_�Iy��Ɉ� ��B2�A[r�iM鈇y�jQ�=s}EE[�F�<�t����~�*m!����ߗȔ|+�j$��e�5JR�����=��.�����������{�N N�u =<�5'�Ĺ*U�Ko�n�/v�W8z�s^�� %9���_������ݶ�9�}�� rSd�0���*S��/��b�����j��"��K$z���YT�p���"K+� W\���떢�+V[��M�#�_�-�)A�e`W����!�n���Bc�N˲ ��44eY����[����j�q���ơ�Tkb��>&B +��ĕX_���9�k!��D��dPt�Un��cs\��[�4STY� ���ta��wٟ����P��\�������)]���~#���V[��ȗ�$"�� ������yr�\�;�o6"���5v��hr*s�l�����"�;<�[#�gac�j�7\nM��OBc�[��U�O5�una��b�~Q�� 9eL4il����4S"Z����; ېN�CL��:�s՞�f������$ -l�j�1�Z�������e��%��2h�m|��ضd~@��LL�e0A���xf�ՙ1�|͝����M�9f���ɜKcI�� �$��h���<^���ցB l��O�hd�#�����:"��c�{��}$&�O(5��uV�-�x>[�f 'O�5,/�8�F��R(j,��b�0��.'�6��@��W�mfv�^^��x����Uo���$�?*�#�T�_�������T�6i�Ǫ?� Z��zօ4~S̎�e��@�^����ꖔ��e�;uT#2���ޮ+�(Zt_?�W+�wJ��c)Wk��Mh<��#��8E��s=9�̭e���~�����LPF�(���"\N-�x�f'4z�s�x����=ܴ�-����Q�Z�V@]-����X|���5ɋ�����4x���+J��Q��ӌh9��O�@��7��O�/S[?Q��jGXs��mT����!�uRB��FC��y�����{�� T8n�/DȚ�|V&�f�����Ɖ�3[�Z�|ז���� 1 ?��ĸ#4I�?���]";T�nJkCH<,�0ܿ��]�!� ����?��~� P�<JS������AP{�{�{�o�ĸ����`q�R���J��Ԧ�L�BX?Y��F��B��!~�G��x���D�s�u�)�?g5�\��������k�}�͡�s<!y٠�(h�S��d�D���:{�т#{P:^�4[N�nm��L�x.A��#�_�������Ng;Jp։�>�T�a�s������Z�`|:�!^Ķ��hW6������u����� ;6����>���d�6�I�&�d.k�j�b<�C�������b��T�H�M��O�$4Q�W�W/B���3��p���7�I(��� ����$��ym�'�2(��ug�x(t��Ų�s�v��C.˺Fc�b�Z�?*����!���W�My���2����%��"��ğ̄��:��ئ��|�7NА��@6(�fK�./E>��]��̿��U䆮���" 7^͂n|P��u��s�a@qm�Y��3���_�ѹ��m8�#5�Ώ,�C#��/�2�7�6��V�le��� !{4V���ԝ��:��h�0�;� �+��sX�`�5��v�zި��0��� �)eϬ!pL�DY���:2��۹����^(ۛ����k�1V#�(,(���q�%7�PRP��k7~�+R�)۠������ -\��� h5B�<soE�"��k�w�?�K�_@�'���9���2����z���B~��%?sm�VS���T��h2';��l�۟ce��3U,��IBuG`��`%���@dCG�q���d3R�٥b|z1��� �r2��}�EX1Y����$F��ʶ;k�3�$���*�/��.��ܷ���e ���A] +j�Ź�R��0�e���驨+M��-.ܞ7W���l��D�C��n�1�
Behavioral task
behavioral1
Sample
ec4732656d83b0d2b746fdc5e6b5f96053d2ab80c2ffa6f9fe4a2778cd8e53ff.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ec4732656d83b0d2b746fdc5e6b5f96053d2ab80c2ffa6f9fe4a2778cd8e53ff.exe
Resource
win10v2004-20220901-en
General
-
Target
ec4732656d83b0d2b746fdc5e6b5f96053d2ab80c2ffa6f9fe4a2778cd8e53ff
-
Size
720KB
-
MD5
6f521d8c7b8714bc4a695ba453052b93
-
SHA1
16bf87e932db93d0a972410f400851b3a8c1fd7e
-
SHA256
ec4732656d83b0d2b746fdc5e6b5f96053d2ab80c2ffa6f9fe4a2778cd8e53ff
-
SHA512
8ace1c7a53eed778956d900664b55e9ac4c7e02891fdb5fdc58ff28099ae5b3ad3ebb0267320b93769a41b34aa08066ea593e766fe78d99d84b2e0c53020c261
-
SSDEEP
12288:MEXWO/F9cj2C1XRBSvumQOO79NmySCMq0OswqE+m/g2BO5dxk2B:3TvFCsu1OaDmt7OswqDm1Bqd22B
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ec4732656d83b0d2b746fdc5e6b5f96053d2ab80c2ffa6f9fe4a2778cd8e53ff.exe windows x86
f518aba3fc69580cce917f63fcc80542
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord619
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 645KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 708KB - Virtual size: 707KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE