=N��P�`~d�`�趛c-jER Z̧Az��O��>��2_�2�;i@3D5���Y��(����k���~���U٦qs��h���� pQQ������rz�؍�' X�*o����:R��|���V��I����N�_lsJB�N��猆bW.�nVV &s��?������p\\�W�������a��S�WKH�� ����F����\��_�cHB��D8o���ke��%��|8�@�9�Vw�Jfi�o.���3����A%CǍJ��$cHks�[����~���,������wdV2Ց2��'��k��i$@]U\�gq�2I:�RI\���ֆ9��K�0�ht=Y��2��P�hX�_���b,�%Ti�9g�G�g�/~H����)�= �Ǥ�ꕂ�o:�I�%�G%�6X>J]�E��/Bx���Q����Q�8�9^b��H�y�o�a3�&�V��)�Ę�&?��k��h�(KX����Y )&�4P���T��1�o����\RE�\��s���$x×�+\$wҞ,V�8?Pk�Qzt�'Im�ć��l�x(�JS�a���&���]�~�ۏ�I�irc��gt��>A�s��t��g@D����R���nO;��mT����ّ�%�Ҳ��u�B�e�,��-B�t�D��s����e+���Gឬ��*��D���d��T�� ����6B�lcS�š�����#p� j��7�� e�J�RQA���M�I�澵��p�7[�������X~ ~��-0G1 7�<p��Az���Yv��gJ�����Od6+�B��i?�n� tp���q�>�"^i�l�v�{�Շ|��gG���8��%�T椚ؼ���-���a� ��f��8Y�������|DqY�]�m&?��}!Cǐ�>�"������f[�z�'�ެ�;}� O�&'*��s��lc���-���^*� �^�6M))����V��r��<:jZ���L�����|�_e���k0��()���;����=�� hØ�$�Pu_\��7�0�ko����-q>=�>P���̟S %����U�&-�a��9���y�3[IEdf0pP��Ɓ��}�&9�5�S�5Ҟ4q��ofMJ�:W� ���P��< *���Ү�q*e�O�T����[nrv�eoz��6�j�3a��[ �,����7�K�»��E+?<l|�0��2"�@%9�g�U�@r�;�O�[�;�� �g���O��P�s�!�3������h�9y((A}qwJME��Nc]��j���:�6<1�{�-4>-m~��m�>��C%�g:��$� �٬����Ϡ�`b��l���%�-�7����v�6����B��]r��X�7��%�6��K�'zK���NZ�P��0s���pCt�]B����fX��O ��n����g���;�S91l$�l���-�L<kf1��������Oc��fc�_C�9W��IK�lS���g�����ON������D�9"+��!�J@ P�̢n�ź����M��}a-����*��n��F�R.�u�e<�/�㒓��)�6k�=8YGZUߺ'D@�B!v�e��L����X�?�4��K*�p�.F�T*�?�6Ȑ4��[m�[�ƧB/h�ɍ@���X�-�.~��?�fm�,��A�,�f�{3����� ����ӏs�dk~t\b�8�"��蝙�������U=xXw�!�=^p����%e�>ie�o��{�����r|�_+k����Vke�o`r&���sU����ОpP���CK�l��}�ϗ�r�27��1^i��a� ���mD5��!9NLyȹ(*[PJx���ޠN�������:�%���� =2�0���t������+}`jWf\��s�U���g`MMլ^���!����F�ۻ��������ɐT� ��KX��"MR�랺D���o���'.�rH�9B_V���f;Ի�s/1DA�q�×N.�������S��Ⱥ�^��+�"�HK6@�{]Nl^��-�a����G��� ��6[>�^ t�����Q@X�d�s�Jr�Vzi��������?M�'�Qc(�`J)O���f���#��E�Z d�jY)8��������g�B�fSry��\t��i�L������ׯ��]�s����`��OB�d�'�����bw~�iw� ��/��o.A�R �����E��ᎃd_2��Jw�A���찆=���������7!fM�3�fD��������������, J�����Y`7I�z�#N�5`�@��*hIe7f�D��9�+�V�fJ_zjjY�ixG���A6#�PU�:o``�N�i�Dy��8byE�_�}�s��G��+�6n���k�C�v��=��-3��F�� I�A�8d/��ʱ�� FY-c$��Fn����1���[`�%��!U����ۑ �/k7�_��� �*����`�d��U��x"��s( 5��]oK�&r�-<�۰)��ߒ@�X����px[���D��ȩ �1}��}�L����B����ח9�I������(5�xD��m�{xVi4$8�şl���΄(�A?F��҉�> �TZ�Ȼ76ew��G.FJvH]4;R�J(C`{&�nD��6,����nƀ�&� UU��iX�kr����٭.k��(��ẁ���ʋ.!�L���)�-j��� ?���=�������?� V������t_禘��7�����c>mJp/|��`�P��َ3�u���&��I0�z���$����ן�ț�ƃ�4���OP[���P�;����%lY(!3n�G�i7Y�p����W�&%��5c���R��K���1���������o����1�zXu��4HK:! �����,�@~�9x}[�f�G@��陴�.:%5�Z��k�o/�mگa�:�� u`�����[�����XwC9��\���K�b9���ܖ���F��ʁ@�^�<�JJM��?jg�+�@�/u�#� w��И̖�<��>,2�a@`�����Ϳ�}��{י�8� @N�((�r&J�x7��ۥi�?9�W!��H3���J
Behavioral task
behavioral1
Sample
a9b1714e1f4e4ec55ad6b1d3ac9ff4a97da088aa3b63000e45083ef9c701f6a8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a9b1714e1f4e4ec55ad6b1d3ac9ff4a97da088aa3b63000e45083ef9c701f6a8.exe
Resource
win10v2004-20220812-en
General
-
Target
a9b1714e1f4e4ec55ad6b1d3ac9ff4a97da088aa3b63000e45083ef9c701f6a8
-
Size
1.8MB
-
MD5
c27138c5231a431485dacf2f487d875b
-
SHA1
2d080357f0aedbcb61b5446293d054b6a5ce80d0
-
SHA256
a9b1714e1f4e4ec55ad6b1d3ac9ff4a97da088aa3b63000e45083ef9c701f6a8
-
SHA512
37e77a0691757e2cd92791e25baf53e8f7836f48749a5256b06cd6994aa35cd8eb26a93d3ca78de961aa2c5aa2c51aac588b3294b587ef69c1326c6a7942641f
-
SSDEEP
49152:cRJzCM2sK7rnfKHcFruXbPHepBkoOYKFhnIWYEBlp8TievOga6h4vno:cZ2brnfKHcFruXbPHcIYKFhndBlpmiec
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
a9b1714e1f4e4ec55ad6b1d3ac9ff4a97da088aa3b63000e45083ef9c701f6a8.exe windows x86
f196609e6594fde6d5bf6284b128e927
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringW
IsProcessorFeaturePresent
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetStringTypeW
GetLocaleInfoA
EnumSystemLocalesA
IsValidCodePage
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
UnhandledExceptionFilter
QueryPerformanceCounter
GetOEMCP
GetACP
IsDebuggerPresent
GetCPInfo
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
VirtualQuery
VirtualAlloc
HeapSize
HeapQueryInformation
InterlockedDecrement
CreateThread
ExitThread
ExitProcess
GetFileType
SetStdHandle
RaiseException
HeapReAlloc
RtlUnwind
DecodePointer
EncodePointer
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
HeapSetInformation
GetCommandLineW
FindResourceExW
GetUserDefaultLCID
VirtualProtect
GetNumberFormatW
GetWindowsDirectoryW
SearchPathW
GetProfileIntW
SetErrorMode
GlobalFindAtomW
lstrcpyW
GetSystemDirectoryW
GlobalFlags
GetFullPathNameW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
ReadFile
GetFileSizeEx
GetFileAttributesW
GetFileAttributesExW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
TlsGetValue
CompareStringW
ReleaseActCtx
CreateActCtxW
InterlockedIncrement
GetThreadLocale
GlobalGetAtomNameW
GlobalAddAtomW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
WaitForSingleObject
ResumeThread
SetThreadPriority
FreeResource
GetTickCount
lstrcmpA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
LoadLibraryExW
CompareStringA
lstrcmpW
InterlockedExchange
LocalAlloc
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetCurrentProcessId
ActivateActCtx
DeactivateActCtx
GlobalFree
CopyFileW
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageW
LocalFree
MulDiv
lstrlenW
SetLastError
GetLastError
GetModuleHandleW
GetProcAddress
FindNextFileW
GetVersionExW
lstrcmpiW
GetVolumeInformationW
GetCurrentProcess
GetSystemInfo
GetLogicalDrives
WriteFile
SetFilePointer
DeviceIoControl
TerminateProcess
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
Sleep
WinExec
GetDriveTypeW
GetModuleFileNameW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileTime
MultiByteToWideChar
WideCharToMultiByte
GetStartupInfoW
GetCurrentDirectoryW
GetTempFileNameW
GetTempPathW
FindClose
FindFirstFileW
CloseHandle
GetFileSize
CreateFileW
lstrlenA
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteFileW
IsValidLocale
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenuDefaultItem
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
SetMenuDefaultItem
CreateMenu
IsMenu
UpdateLayeredWindow
EnableScrollBar
MonitorFromPoint
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
UnionRect
GetKeyNameTextW
CreateDialogIndirectParamW
EndDialog
LockWindowUpdate
SetCursorPos
CreateAcceleratorTableW
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyW
ToUnicodeEx
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
DrawStateW
GetSystemMenu
SetClassLongW
GetAsyncKeyState
NotifyWinEvent
DestroyAcceleratorTable
SetParent
RedrawWindow
SetWindowRgn
IsZoomed
GetMenuItemInfoW
InflateRect
UnpackDDElParam
ReuseDDElParam
LoadMenuW
DestroyMenu
LoadImageW
LoadAcceleratorsW
InsertMenuItemW
CreatePopupMenu
BringWindowToTop
TranslateAcceleratorW
UnregisterClassW
DestroyIcon
IsIconic
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageA
WinHelpW
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
DestroyWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
OpenClipboard
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
CallWindowProcW
GetMenu
MessageBeep
IsChild
GetTopWindow
GetNextDlgTabItem
GetNextDlgGroupItem
InvalidateRgn
EqualRect
IntersectRect
SetRect
IsRectEmpty
CopyAcceleratorTableW
OffsetRect
CharNextW
SetFocus
ShowWindow
MoveWindow
SetWindowLongW
IsWindow
IsDialogMessageW
SendDlgItemMessageW
GetDlgItem
CheckDlgButton
PostThreadMessageW
GetClassInfoW
DefWindowProcW
MapWindowPoints
GetClientRect
SetLayeredWindowAttributes
EnumDisplayMonitors
SystemParametersInfoW
GetMonitorInfoW
SetRectEmpty
MessageBoxW
wsprintfW
RemoveMenu
GetSubMenu
GetMenuItemCount
CopyRect
KillTimer
SetTimer
InvalidateRect
UpdateWindow
RealChildWindowFromPoint
GetDlgCtrlID
GetWindowRect
GetClassNameW
PtInRect
SetWindowTextW
EndPaint
BeginPaint
GetWindowDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
CopyImage
SetClipboardData
CloseClipboard
EmptyClipboard
CopyIcon
CharUpperBuffW
GetDoubleClickTime
GetIconInfo
IsCharLowerW
MapVirtualKeyExW
SubtractRect
InvertRect
DeleteMenu
WaitMessage
ReleaseCapture
GetCapture
WindowFromPoint
SetCapture
ScreenToClient
ClientToScreen
CharUpperW
UnhookWindowsHookEx
HideCaret
DestroyCursor
DrawIcon
CreateWindowExW
InsertMenuW
GetMenuItemID
AppendMenuW
GetMenuStringW
GetMenuState
EnableWindow
GetWindowRgn
IsWindowEnabled
GetLastActivePopup
GetWindowLongW
GetParent
SendMessageW
GetWindowThreadProcessId
GetDesktopWindow
PostMessageW
PostQuitMessage
RegisterClipboardFormatW
SetWindowPos
MapDialogRect
SetWindowContextHelpId
GetWindow
CheckMenuItem
EnableMenuItem
ModifyMenuW
GetFocus
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
PeekMessageW
GetKeyState
IsWindowVisible
GetActiveWindow
DispatchMessageW
TranslateMessage
GetMessageW
CallNextHookEx
SetWindowsHookExW
SetCursor
ShowOwnedPopups
GetWindowTextW
GetWindowTextLengthW
GetSysColorBrush
GetSysColor
ReleaseDC
GetDC
GetSystemMetrics
LoadCursorW
gdi32
GetTextColor
GetRgnBox
GetTextExtentPoint32W
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
CreateDIBSection
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
OffsetRgn
SetDIBColorTable
RealizePalette
StretchBlt
SetPixel
Rectangle
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetBkColor
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
EnumFontFamiliesExW
GetTextFaceW
SetPixelV
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
EnumFontFamiliesW
GetTextCharsetInfo
GetTextMetricsW
CreateRectRgnIndirect
CreateCompatibleBitmap
CreateFontIndirectW
CreateDIBitmap
CreateHatchBrush
CreateSolidBrush
CreatePen
GetObjectType
SelectPalette
GetStockObject
CreateCompatibleDC
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
GetSystemPaletteEntries
GetDeviceCaps
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
GetObjectW
CreateRectRgn
SelectClipRgn
DeleteObject
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
CreateDCW
CopyMetaFileW
OffsetWindowOrgEx
msimg32
TransparentBlt
AlphaBlend
comdlg32
GetFileTitleW
winspool.drv
OpenPrinterW
DocumentPropertiesW
ClosePrinter
advapi32
RegQueryValueW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
GetUserNameW
RegEnumKeyExW
RegEnumValueW
RegCreateKeyExW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
shell32
DragFinish
DragQueryFileW
ShellExecuteW
SHAppBarMessage
SHBrowseForFolderW
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetDesktopFolder
comctl32
ImageList_GetIconSize
shlwapi
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
UrlUnescapeW
PathRemoveFileSpecW
ole32
StgOpenStorageOnILockBytes
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoCreateGuid
OleDuplicateData
ReleaseStgMedium
CoTaskMemFree
OleRun
CoCreateInstance
CoUninitialize
CoInitialize
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CreateStreamOnHGlobal
CoInitializeEx
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
DoDragDrop
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
CoTaskMemAlloc
oleaut32
VariantInit
VariantCopy
VariantClear
VariantChangeType
SysAllocStringLen
SysFreeString
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
VarBstrFromDate
OleCreateFontIndirect
SysAllocString
GetErrorInfo
oledlg
OleUIBusyW
gdiplus
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageGraphicsContext
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDrawImageI
GdipGetImageWidth
oleacc
LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject
imm32
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
winmm
PlaySoundW
wininet
InternetOpenUrlW
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
InternetCloseHandle
InternetQueryDataAvailable
InternetQueryOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
Exports
Exports
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 297KB - Virtual size: 297KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ