ժwT!�����5 �� ���� �gc��v�Y]� �W+B�T߽��g(�ǹ���w�QUЗɜ,���f �o�r��?�~x�e̊{������|�������Y���}�Y% 3O_� m_O6p�d�ܖ����(���a�y?&�g�S>����&u+�J&mvy-ZS�UUNy>_IK�ް��I��"R��X ���=� }5��eL�X� .��ޫ�JN�q{��ǐȊκw�X�qi-��4f��8�rx���?� ϛl|V>?6�x���y��?������ ���DЅָl�{ �x9gЯ�t�W���xR���m~�B��?3(���hh� �T ì�A��,bxB���m��+$`0�+d��2m-�'�O�In���vq�ڗ�䅹�E,�6��#��q��g^���3�Hv��R�$�7\���w�R���&3�Zª ��aۮYQ�e�AUIt5S�������Ê$�n���b(�|Qs,��A�3۰��Y5Lq+;��>�(8���fY}9�G�H��. ��?1�"Oa�F���E�����/RI�L7���)�$��ٽ��oU��US��T,��=�5�+���q�B���␈���P�>��l8��{���T���o!�W3�+��伹T$�>L��3T������<�be�9( r����E�u��͍�]svV��g���G+xS G�O@��O*`��Br8�8�j��+]B��\{�7��r}0����`��63�7rb[�g#k�3�m�rH^��sO�G�������ؼZ���eZ�YcYj>��X��5vo�L��S�<���?�g����l�|m�G%-hB�q̭�˂g8F�?Jd�3�5$�' ���Dxs(P3bp�K/"���a5�we��7W��A.�oL��|F!cw{�ژW�pTb�\��}Ңb� ����9�2��)�1%rK��I���zYt��=��1���p�雳+����Ѝ��N#q_�}�!��U�IE������D����#��۬ U��%�4��-��Mt�SO��0� �+b�vF>��[���$j`[ �� $-�_�۫i�B؈�7(�u�#�L����f�����V��ڞ!M�F��S¶�u��*J�9�b�FZ��}���{�s�A����D����pLi�5�-m��[�ь���R���y�K����T��}Ԯ��'|IQ5�䗏B9��i��{����o��(� _<~��i~���_�W�>�T��/ה���;��������@� ��b���xO*��kn]ͥ�'"O��_En��>`�y�L�Ǎ+�g������V�tŕ҇�#o+�"����14mA�T�er��M$�g�Diū j.��`Q�]��g��`;�F����I��2�_��f��)��$�Qdq�F[o) ���_�j�_!�a<�C�T\�������K��,�q���)Y�AQn\�˺�S��|�ޒ �,�^59_A�E͓<L����+���"�L���U��8݀����c K�U瞢�k=���V۴=���T=#-9<gI[� ����:P2{Å#��`ǽ.��/���i�~�������2�tV���m�ة �o�~*ӏ�������9H:���~�p����["6�:�2f����a�*"�����i`E dV�X�I/#��U{�o�[u-�683fܟ�HڶHV4~�;�CS6��w�J�O�~a��Y��㾊),�Ϸ�_wpNh��� x��s|i�x��P�KE�O//[\�G�R�T�\1�ߚ���]-�j��SW��;(��e��P~ru��>�pjoE�|�$��7�� Y�5ub���3�C�E�_��FzE������7��E��8�d|��"��u�ڼ��++@;@4ig �5.����h� �J��ȵ��ڷ}��wh͍o�3�XQe��~þͣ�' IB���g��+f���/�M�@��`�Q&�Z��siX�F�>)���@S*�����Oyâ�B�A`�G+�+.�}��1�WN6��`����vͤ �M�����F��_���15 �+ҭ�h��SA�Y����eQ��2�G�l�KT��@�'"~���FOL�����y+��ȸ#��X8bL��0��D�:k��Hƺ���z ��E��]p[f,q��N�X��rLR�~ �m���o�#�̘Y�̊����%��W�a�Bp��Y,�+[Y�;���Ⱦ��e���F�̠�?�\�ޢ� ʚQ�|��a�7^:���?t� ��E�nڽ{���fpҔ.���4��.w�d�vݥ;A�j�Mn�K�v@2�k�9P}�g�'��`f���G����6��r����PS��(]��C�I��f���� A������5�o���M��&��g.R�9ߡ�e$>(�������jrS߾�t�z%ۆ"z{�<�'z���ʐ������i�Z&������~T�gEp���}n�K������W�s�}�֔+4g� ��AR�} H�?Tm��;�kfK�O>h� ����H�Z�X�3=��������*�6������:��c��u�Z�{>S���ƐY)�ԑ�c�"��_[]�m���<�v���N`{Q��3Ŵ��hrZ�7u���LVa;��c1���鱮��%4��<uU��@UY���-�n8����5'=YP6���Uz�����n�ոF��9� Q���cp\Tsyggt��$!S���la�WC����Ҵ~���pi��u�&tshz��^1���8� n�1�%k �w\�����_;6:̯ς� �> �2H�)�Bx�(�I�pk��W�Y(��P�6�i|���z����Yj���3�����`�M�?��\Q����aTq?�8ϧ��Ҍ��"8��� �d+�KzY��,�::��v��\t�Q���;n^�2ݤ���}���������V�r�2����C9�n2��H��|��o�s����5�Q�Vn�/�����{� ���*�=��vA�(U�?#� 6qq�qA�m7܆��a��&� �%rn(7!����D���cwXIǕA}7�FVs+9�,G &ȶӨ6�`��9
Behavioral task
behavioral1
Sample
70eb4893f9da86ca9d124093417a0554f1c56c2a31e265538cba3e5b6265b0dc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
70eb4893f9da86ca9d124093417a0554f1c56c2a31e265538cba3e5b6265b0dc.exe
Resource
win10v2004-20220812-en
General
-
Target
70eb4893f9da86ca9d124093417a0554f1c56c2a31e265538cba3e5b6265b0dc
-
Size
3.6MB
-
MD5
a176c9a824f1de6c5b0e262a818a7a03
-
SHA1
c1ecfaf3e80a8241f9cbf6d993995b641e523d53
-
SHA256
70eb4893f9da86ca9d124093417a0554f1c56c2a31e265538cba3e5b6265b0dc
-
SHA512
5d627233b7f1f5ac1516b36b7bcb9160fc59737b17e7ba22bf5ed78b43faccfef9de75616a479ffe0f7888521b5c5d6889a059803da39f605b30d88bc5bd8bb6
-
SSDEEP
98304:fs8zRM2za2p9G2Tr3aBgDVFWvg/df5LGWG/m:Xr7VPN6SRG//
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
70eb4893f9da86ca9d124093417a0554f1c56c2a31e265538cba3e5b6265b0dc.exe windows x86
cbaf468560dfaaff30b37cb9c06e4276
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPause
ws2_32
ntohs
version
GetFileVersionInfoSizeA
kernel32
SetEvent
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDlgCtrlID
MessageBoxA
gdi32
ExcludeClipRect
winspool.drv
DocumentPropertiesA
advapi32
RegDeleteValueA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
VariantClear
comctl32
ImageList_Destroy
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: 772KB - Virtual size: 768KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 84KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 748KB - Virtual size: 747KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 108KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE