�+9w���N�1Y��6 ����Һ'�Rr�$��#O�q�g(�W~��� ��#,Cu�!��"��k��N�7�ا��)О�W�נ���ܺ��]ZT9�P��9TQV!��Q�}P���1�p��A��7���X��(���]�6$�y4앒P��M&n$l�*rl�1��K��HOˢj���$�\ڎ�l�0������I���m{��m�Y�:r&)4A|�����H���\8,�&I�d8%�]B�y1��ֻgx�a��N��A&v�8�~/z���)����~�Q�����h�&��4��@����(���`��z�u_:^��i2%2��'��o���+�x��MɅ#능B�C�qI���f�f�NeϘjM#Y��9�pܥ���%4U�y��^����%Q���z��:�(�ny�����" .��".,�D:w'��\�Mm 7��EЯ3->Q(K6����H#��X�E����P,���$�Qx,���I]����:�,�p�9��i-&���T�ܣiw�[��ȿ�'�,3 G�zo�BJI��\�<}_\a�Lɾ2��ă�]� �[�R��z�!�����a�����.��n"դ�=������C�4� �9��{Bi��:�x�*'���/$h�\XE_����v�n{���8�1s�ae��"����WJ��g��w]_�m�I�0�����s���6鈻l�1PK�����C��7p�� A�?g�����h7�ͫ��PA���@O�\C} ����L�(�����CC~�E��|�N 3\L��xg����8���FHsN��07�6�#�a��`69�Gy<K�����Qz������arhV�WFi�DY!S�4��cn�����ޤ9�4��1�� �&��:kⱭ�Nv�=���2��*i*Y�XW��a]t�焮��26�ڝ=������.;��rZ��.������C% Ke g�Ѧ�S�X�Ȇ*�4��:���IW�����;G��!��Yփ���&.�K�X '��3ܯ��!9��X��c�C}�τ�,l���}���+��)I��.I��O����bggS7Z����P�i���$�U��d��C���+�,8d)�-���5��X ���_E7�Y #����*�$���#�N0[.!�yi��b!S#��Hzu�PO�*�$���� �&�E�U:����GJ��t։o�ɧN�]C.=�(�:��Y�e7�4V������MĶ��%���\�ľ�o����ù�rC�@0ɮY�z���2�,Jk��@A\�������ԍ#.ɮCG���X^ij�7)�����X��j��z� $ }�y��m�V�q�Tc/���e��?�0;0���g{����'8R�������y�EX�,@cu,춥�:1���c�H^tѝ%��7��P��3�=U�{v���5������b�]:�ř�%����*���A�����>��*���T�Uy7Ca�zS�az���m�QS����i��XH�#�l,'����g��|�R 6|�N2QR�=�� V����V�0 W�%ֽ��PN�w" dF��K���>��i�x�������,��bM���%3T�E�(�+Ǫ��;~?��6�Q��0��8q�PJ� ��5��>�c D�j�x�W�z���|7�Cb.:��f6�"�`��y�kN�����ٕnH�Dž!��[@楩�c�5lg��K`�J�LE���[��Ra���^l;�l���&�t�ȉg����yo��"���G�'�.�*�fg�e @z��M'��崦V�'�V�,�l��Q��*���~��Լ�ce�uJ����r���sd�,7��X�j�`R�.��1b��+�_/��&P_AB}S8=&K���j<�5<�T��3��oG�7��0��Nb�l�q`;������x?�ǩ���w�Q-� �cȲ9�����<��#P���x� :Pm�Tp{$�-��5*(�Q�g��$��v����}%,m⃙����"���PIU[�Шu���`��*YR��J�ܳE��q�+�2�R=�}�Z��e�%T����-�Ҥ����}�3�&7�h��yk���)08� T+�Obk*��w?ǁ�߄T�#F��!Ȫ�$)T�Az5:^�ͷ,ka�&9����ۢ�>�����|.Ywc���y�# ��ՉG̪��*Y�%y��ݫ%N=v~����P�ex{���!��0f$7�8iI���IC���X��g��x�c�K�a� ��㡨��"c���l�^8��Db8���c��WkM ��� ��0~8����xH؟�;Z\;K�kn��{��-��~���jYA�=���O:����6{����?���$)Q��l4�j˚�Z�.�L�䗠��Э��d"��MJk���+B���Co1���+&�`)Xd���^[�!Ā�np���x�n���d����Olr=Ԕ�2LWp�)��\ٺ��/�&K�l� �����0XNS%�g禒g�ɺMa.��.a�|,A���Lb~i�O���߮j�|���H+c�!��0���+t�, ���!N,��K���%�49{K-��?�v��fs(����y�yԉ \�R|i �-�f{��Xũ���3��U����O�ˡiL('��q6�F&y��dX׳HI$��ZT*0]ٮ_O�sed�O�L�"��� �c;��&vc5�}��0�"�ha�ٿ`CYZ\�ji9�o��|=�焏$a���#W$�9�"=�Gܠ50�WÔK?���ȩ,������{S��F���Y� ��_���uZǥ�Ȃ�>x?,���{aDڏ��Lo;�����EԈnܰ���R{��C�l R�|�dc�E-�����;�*0;y���n����}�6q3�EF�[���N�ާ����u#��K�I.��\-�����`:����IqZ��c�U _����h�� F���:6�Eo�BΆ�7��G]ʜ�]Cd����1��.��3n a�L��sU��"!��h�_��U"�)3�sV1效������3�oU��X|�H}��S �;_~;V�g��\D@��D�h��
Behavioral task
behavioral1
Sample
1076ed81b763f480025200e49db571132a14ef86dd4383e7302a46ccdbff98e7.exe
Resource
win7-20220812-en
General
-
Target
1076ed81b763f480025200e49db571132a14ef86dd4383e7302a46ccdbff98e7
-
Size
291KB
-
MD5
48049a1210b8f33c20a7db96027cb6c0
-
SHA1
20fedb5e5c0dd72b30f9c5af630b69feea459eb3
-
SHA256
1076ed81b763f480025200e49db571132a14ef86dd4383e7302a46ccdbff98e7
-
SHA512
2c67c5b513346487d97d3e002a1beae879f628006f378f5eaba040004108c229c50e79bcd294d60e0ec5d178ce80ad20f903df4f2316a5766e9aa8fcbf17ded6
-
SSDEEP
6144:EWHlXWpdZR12wg/PIg0SGmlH5BrN5tjLPqp+x5StTIhLniB5YC8C3rnH8:EClX4P3g/zr75HN5hLPqYmOLniMC8Crc
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
1076ed81b763f480025200e49db571132a14ef86dd4383e7302a46ccdbff98e7.exe windows x86
9663f0c9a5b5d514dccd753cc1616a27
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEvent
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
shell32
SHGetFolderPathW
shlwapi
PathCombineW
msvcp80
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
msvcr80
free
user32
UnregisterClassA
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 204KB - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE