7�r*��c��{��ۏ>��@;K��������-��t��s:�`� *RY)�B<�R=��JI�D*Ҥ��A�/��8+������GB�zq�CBE����^����%Xz�f�C�� ՒB%'d����x��k�dPSF;�i���2�V/�f����j;�u���fܪה0��B�p�\H Yo��U��и��5���`k���dƅ.V���Iʝ:��,��mUC ����ί��h2���+<!��:ؒI>�&` {Ґ�!@��B�!s��y�Wz�v:~|{5l4OWn4�]S��}������I�|4;eu�(�0G��Y�w��������B�`�S�������?7�þ[�H.O��gT����G�T��0$�@���܀(+����h ��1 �����O3���E��j맙�~���ؤ2�Nt�/ip#��d9��e)�����-J���=N�b �}o����*H�U��#�����2��X�kWL�{%蔳O1gһ��i�IT�Ɋ��j옝f��@U�j��������D�S��kDuW�j���v�#\��\o�F�;Z�><�<�j�go���g��W��M��*t.N�$�5x��$XcvI�N*|ܱ+�a�-�9(��Va1o��S�@Q�O��Ó��t��� �i<�(�� �h�P\�.8��U��O��-A�d&Cu��'�^]��u���@=�:G����KQ*�b_���H���.G�e�J�0�.x���S�0P ��� �*������X��ڮ���3\��K�Z�KY�MB���S;:4}�f4�5WF>&�[�e�s�� �����g�C}ԫiQ�Q=�~�_�}�_n�{�H�����9�kTKxV�E����:�����xd�����}����*/���+#��K�O_�h�1�����~b���������-*_��_k�]����̊��Ji�j�����+7�3�u�x�C�6�k�1f7҃�@~�M���7��r3���w��m~ ���mt�Z'z��y4�_��)�Q���.��H��m�a�հ���T_�yK�ڤ`��S<��! �}������S�fkD>�]F�gΉ.�v���R��#����;�ԑ�S 6�R�U[m��M�����~M�;����G�@3���T����C��&����+g��-�D���궿[��K�6#� ��C�k�qzPbp���Ƴ�+�� 4i*�jQ��;Kކ��i.�z�ŕH�3Ou�4[#�N#o�nr�B ����@D���$)�qXO�S[C��%U� �>��J����r��àu��F�K[�Bހ[�z+��D� ���p����2���{��ݑ����*��I/|6�<����RA#��"�å�qeE�ӑR̚��w���h��CI���w����+�dc�č 6��+����N�YTZ���ݸb1�;�Y7��B#0>a��hBŁd� @�"'G����a���' �ۅ�$����>�,�P3S@���-�с�e���jv��n�#�j���9>�EmKkz�����Yٱ�ƺ�f0�h5T�����T�$+��.�elo!z!��\ܣ}bO�������{,�,���1���bL�9�Q!\3�������sي)YsB���<����dѨ��aŝ^}�������E9�7�]�6�L��\�(#��|h��u*�9��r-?�P� $�*��}�ORL�rQ�o�}����Azι�@�E <�Y:6��}[r�}��/�����dZq�ۮ� *]E#����ǀZ:�h��SsUVD�@��O���9���N�n� �TƗaoIdR�ːT��(�f2[���-ؽ`�K("ۤ��g��������g�;�v�9��D��m1��ڕ�jVn/:.��:�f!�KF`�����x��{��~#&Da�9� �Ɏ�O��6K� �Z��S��d�O�=�2���`l�+ShbjNW͟��~�����M�V�L4ɳ�V�P�\]è}pI��ɩ��j-���.˿'A��z"a�p}��-���?=��2�E\�����@c2=ap��I��3|k5$�z�0�_���`�ru����G��?�[fV���"f���3 _��3����?��^Y!�y,N��$ZeE@k�F���!ϖ�ͧ�0�D�_IBR�<qk����YG 392 �9�M�z.�'~���#����A}�`�7���חk����w�Hv�&�4�W���5�s��S38@1~�H~I��5g�CO]\�R�r�guj<ď���i�l���?�jz_�z����)k� 8@xr �%������a��j�� ��ڧ�9w[�z�b�E������zB��1J�9X��Uٞ�_�p�^�4����erJ�(1����VD�z��3�pJ~Y�j*T��P|�׳X{��D�di��Gl��a&�����s��G��g��!��F%���?�hLj,E�w�>f�1��)�x:�!�g$�b���q�A�]�yy��G$M�����g�/�o����E4ڳ�̊m���F� Q�cVCJ{6ӔK �3Q#�J��& ��M����ܿ��E:(�4���\Pq^|�qϢ��'.�C���$ ����[��A��n&���r3��g�8��[lC�}|a�h�{nRkk��k�pq)�u_S��z�$:6L�{��M k�"�~n���(���_dь���ѷ��W(X�b��C.nEij�bL��{lkE�%�E!X�i=j�xY�-�-�}�ޘ�a>=�بRt^a\+O�g��GTAL�kS�����(C�:��.7�, �����N��z(!��l�>�؝�=P�)���:�R�N/��c������*?�w�PBs^�}����jhD��'�$��U�� j����̹���L%T.5RI�Ҩ�-Y(���Lׯ�G� u���:��P>��s(/�����{3Xًc3]գ�~8=�2����d갪9�҂����8�055L�Y���?��Ij����I~iB(�6ݐ����T �����?�2W�c����6��SIA��.�s�y�����ۖ��LO�XK���G�ɐ������O~���q��d^�Ҙ�"�6mDǫ�뚽٢��OZ
Behavioral task
behavioral1
Sample
07608e855a87ee5e1b3138efce3bd8b1868bdd1996129ef105eef13ecdb79402.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
07608e855a87ee5e1b3138efce3bd8b1868bdd1996129ef105eef13ecdb79402.exe
Resource
win10v2004-20220812-en
General
-
Target
07608e855a87ee5e1b3138efce3bd8b1868bdd1996129ef105eef13ecdb79402
-
Size
1.4MB
-
MD5
6317c2e236e917c71463ce2f45dd7600
-
SHA1
dd1340e115f65f95025284562eda5a12fdc0c375
-
SHA256
07608e855a87ee5e1b3138efce3bd8b1868bdd1996129ef105eef13ecdb79402
-
SHA512
de971fc42568c780163b869ff7401ab8521e123c47b7e8f8e225188346315370f3c2bdbe0428d2af64edfe86784a7dd0b6f40d46d2460265b6263b7b809bc50a
-
SSDEEP
24576:p7UuepVDJ4JJtIF6a523ztXO5p/YJMSR+NTapZrR4e89BZkYYxROpPXiI3CGzM27:p7UuepVDHfY32/O1ANTapZrR4e8BklxI
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
07608e855a87ee5e1b3138efce3bd8b1868bdd1996129ef105eef13ecdb79402.exe windows x86
53840ad997a8075f4a4c8ad717ab2345
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableWindow
gdi32
GetDeviceCaps
winmm
waveOutPrepareHeader
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CoTaskMemAlloc
oleaut32
LHashValOfNameSys
comctl32
ord17
oledlg
ord8
ws2_32
recvfrom
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 454KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 292KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE