e�[k��bx������gBg�n9$n��oD��A���f�L)��Y�+V��% �R��[N��`���Y����8<2m>D5���ᣦ��{$-;�|]���f&$��QA������x�q��Ew�u��9$@G�b�����m��icʃG���(Q�x��G:���c��"�n����t�{À�V����_��W�6��'��?��)9�)` �@xūI+� u�_�����v�����C�ɯOҖc�0@�ŗ�Ԧ�I���_��D�\a6��l<�/Sz�C��d�!�9��w����n���8?�Aݦ�$e�f�_�(V�Yg�Q�t�^}�.���Y5���D��t9�\��p��Ԩ��v��~�#Aa�n�KOnE ���aD}@�OIt�/�K�sO.Y)���)�hw)�ӯa� �̾�QS|��jK���%�{a�=�S��K�(�3��yzW�%#�W�t�x_FM�?*�/�4�W�t���y��;��������56E�n����u���2�D�~�Μ��W����m_߷ne�����5�s�����W�������S ޡl�:sP��l�N�ʖ�W �Di�쐇�'Y-���l����F�L��g�ӌ=�mt�۽��'< ���M;�t@ �?pdn�g�)���N@�����pI�������[Y��(�=�>�x �~+�,+x�-uJ��Oū ��|"J��HU;�y�|-�8 �m)��+ԄsZߠ�K�h!LW�Y����:�CA�&����x_nX��Y��aqK�%�X`����W�0l�_0�1���+Oe��S_r�J=�뱐W��N�@f�K�٧p�k^C�I7�*� ݻ����{:��-S�L������<����ܖ/���ʋG��B��y�mZ���s�{��b[M� ���tΫ6��u��\�`��}M]����@����.�x?V�~U7��-M&{#עG'=��O�:�Q��-"�zg"����N�ӈ\� ��v� �I���Z�=C�Kc� ހ9����[�Y Tu��.^�����!O���W��GT7�>Yk���a��yoÆ�ݎQ��pd7|��>���}qf�A�4q���'Q�e�q `��4Zd�`�5��$q�J��K�I��^U�Z�Ko��Tf���&BH�s��l=oɜ�o�#Qo|A��q {�dLn��q��%о�r=���K�#�[J�ѧ 3�����Xۼ��,S�)2�xj�O�Z���I�.-CztU����k^�'�����J�ʧW��5*�����3�)��~�|��|@x|�oh��;P�3��PG�L8���R�K��~\���etd�������$y�[���eY�x��b���l��#�D������4���nAZ��P]���� f�y�y�R^Xozv�����0����A����Z�*�d��F�:�{�3*�!�w�����I�sf�ǁ��;���Q��v��Iar2y)���6�ר�sN��eT�c��v}�����a�>h�?g��K���;�`�ksm�I���eS�(Ǭ��7�� ����u�)ԗ�&�<�5�чr�F�i�J����,�@r=��&L9Nٕ��ixq��O]�ۨ�i��u�ƣ7�.H�xOc�E�tbQK �[) i�C�v���BU�<*��W�՛�O���� �˼\î��re�7V�9�5|U`A�I+�qk ���S�k��zh2���P�ƚo���3WU����q$���n��r��D���Ĺ��܂�����8���R�����Ƌ _�6q�5�Rc�P���nH�g����10h�<:h�T���R�'��9Bo�p�FI��]�)�R')&U�H�ZX�n>f���⚇^�v���)N��o{H��ʠ�^�]���~��b���[HH���s���{�y$P/�z�gW�I͈�7s���Í�� ֳ���]IQx@������}����`r(��K����"z�'0c}�� D�q����!��yUl���Y��W�O> �$mZg-,��}!8�>� I�����e�Ջ����I/�C8�,-�����Q)Y��ʕ�*Ht�y]�&��沗}��T%HEҩE&�3C��I4E��k�j�������-\P'*U�ӭ�.����*�t臨>�v0����(�)hb��#�C3�O����`Y�ݏ?�M��{ ����=�H�1~��M/�\"Ē��r��4���'����r�Z�i�.'˵��9w����{[@k�\簖��~�����:h��|�i[�u�9�X�x6$��B��(L����,|�� V�/�WC�B�k�[��1������NQ0���&̊����F�����'Ԭ+��M��|y1��ȲW��x�=L�����Zh�3���J��a|��=����<߃ȗ��6"�~G0kB���>�������cV��\RJ�3���s�*>�N&���89~�a#��>�S������UƂZ�`��F]�D��<8R�n�͗�|z2�/���:��g)!N�V�̕�'�(Mk"K4�T���f��OTI�v����h#�x�u�'��L�Uy���/�r>��Q��XT�a�*J'A%u�� u��7�����Ӑk� 0�-���k�n��ֆ����jN�-{��9)�����d�(qװ��� Eӄ:��҂~h�}�+ƳyA���@vt�s�� �{��l+�Pd9!�k����vH�f˖d�P��o" �6�ֲr-�A6ҹL��z�óu}�43��{f�R��T�¡-+LO��Z��������)���-���z�����ñ�wb��B=�TGO�N)�ba�2�=� �S��1TFB�Q�hδ��IÁ4�ј.����ϗ��rO��b)�8C ��A�����o��H�8!�i� 2�z�� K�M� ���D+>����P�?�J!�|�#�@#4/B9�/�eʇ�4�0����gZ%��HZ��&��a^�=��y���Q���ʪ�}� �1b�F��f� B�#�QQ�D�Ū�=b)�"k���ڼe�8qq�����k�b�� ���p.�L�q��*�L�������HY���yp�ܓ�J&��+�� r"�/`�r���z�`�
Behavioral task
behavioral1
Sample
8712dccc2c007e4c82ae207b5b53e20f10f69c3d952b1187fc22c5800172bb2d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8712dccc2c007e4c82ae207b5b53e20f10f69c3d952b1187fc22c5800172bb2d.exe
Resource
win10v2004-20220812-en
General
-
Target
8712dccc2c007e4c82ae207b5b53e20f10f69c3d952b1187fc22c5800172bb2d
-
Size
80KB
-
MD5
32cc08d05fabd23bcd20c8cff84f8531
-
SHA1
047fe7bdbf6cdcbb40517d57d6e2f18fef6b40b7
-
SHA256
8712dccc2c007e4c82ae207b5b53e20f10f69c3d952b1187fc22c5800172bb2d
-
SHA512
41978d025d6170956539ac2e7d460a939f6c9c11c82971ca064546da4e284e2aa7b1d061d113548530783b89bc85f474cc79d80587133073e8305ee3a65f4a3d
-
SSDEEP
1536:/G4SdMu+F4CRLCBBe9hK2+5w+wwirFWrSfkL2z0W:oONFDkA9Sw+wwiErSfkLa
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
8712dccc2c007e4c82ae207b5b53e20f10f69c3d952b1187fc22c5800172bb2d.exe windows x86
8403fcd6cb913b5f9c599fd62d90c4c3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaLineInputStr
__vbaStrVarMove
ord588
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaNextEachVar
_adj_fprem1
ord626
__vbaStrCat
ord660
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaVarTstLe
__vbaLateMemSt
__vbaForEachCollObj
__vbaExitProc
ord595
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaBoolVar
__vbaVarTstLt
_CIsin
__vbaNextEachCollObj
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaObjVar
__vbaVarLateMemSt
__vbaCastObjVar
_adj_fpatan
__vbaLateIdCallLd
__vbaStrR8
EVENT_SINK_Release
ord600
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaPrintFile
_adj_fprem
_adj_fdivr_m64
ord716
ord609
__vbaFPException
__vbaInStrVar
ord645
_CIlog
__vbaFileOpen
__vbaNew2
__vbaVarLateMemCallLdRf
__vbaR8Str
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
__vbaR8Var
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
ord611
__vbaLateMemCall
__vbaVarDup
__vbaVarLateMemCallLd
__vbaUnkVar
__vbaLateMemCallLd
ord617
__vbaVarSetObjAddref
_CIatan
__vbaStrMove
__vbaForEachVar
_allmul
__vbaLateMemCallSt
_CItan
ord546
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ