��ʢ!����=��,�0�{��k=$;�Fy�g�s~�г��ZP�e#M��P<{�F%R�$����o��H�Ƽ�~?ip~qy��=>N�1 ��%w�z:-9�\���ϻL�C�l���F�� ��}��=V5Ov��N�co~���}����/_����1~�+)��LΊ����^I�MD��f*�9�*����>��Ot,"����oDgD*Lڣ�D������`���)�h��<z�����^T��@[wMq֯��[�=z����剎�g���ӫ�p���`����/V�8ɯ�����[��>2�TI�ݺ �E��Ш���h]��Ht�t�?��P�-c�Pd�K��7�S,zpǴ0#����9���!J���1mؿ�&!�t�1\`$4k��8J�I\7xbjw��z��5��c�z~��TK�`b�mމ�!1i����Ecl��a�Z��ڛD���3V�-�DF��XjM{!@�V|D�@�ܱb2��q�%sw55F]{��V��Ȍ)l=�N�I[c��%���i��R��l̔qpb �d��V����|Rȹ�_ҩp��W@-9莫���Z�; 3Uf�t.�q����0m�ou��ư5�:�pތT��9��J���a�(�X�ja�4���� ��TI5�������%%��p��s�)M�I:��hr���zθ{eV��G��\�D�1� ��!Wi��͆|�W[�3m��!s�g�9��1^��A�U�"�(w a�_K�����N�m8�+R�;����5�}A�/���ȧ|���*b�O��e��>6� �Ǭ�c�� w�R��NbҪ����*���R���5l�a�ڭ�W�{/�#g�)�.9'�:�Ӊ�%�����V����O�~�Ι+��l/�ׇǔ`&-*��|���z�z�e�iZ�c�0��������}�+Zů���E�K+3UJ�)_��ؖ���,�ⅳ�ra���)���85K.�Y����=��3�q�m��^�F���.^��� %��౨c�N��4beC?�l����$�At�Z��'L-҈�Y�~#�6�$�7��i�����$o�� J8(0<��I��(��;U���d��C!Aaj7��?��PN��p��CDM��}�\!O��x�k�I+<�.N�EF��gX�7�V� } ���>�G�0+�r��'o���%"�QB�`�¬>M�����"e=N�Dn�����D�[�r�>�C�LR�3W�_�_�5:+�E�:=�mL8ۼ���56]Ɲ������:sfu(��Bl��G����+ãW�3�!?���-l�eF�)��1C�9��1�+�F��>M��^<�Q�`�P����{��j�٧ϫؙP�D�zh^}����gP���L����n G��������W="�4�<�KpQ��7f�T_���ٌ���ө��4T���х�2 �]�L̉��܁��oEs��d��� �H��#tzj�_���V��״(o�=<6tT��B���!��-'Sx\&���}"F�V�����<�jP��4�U��l��oZj�3��2(/<6Ʒ� R,�5�i�(���W!�?Ԓ� �]#I^Xa��Lc�iM {qVM8o��F�LvH���!F.�1�<�Q� ��k5��2�yhӂ�����F�3�um�z/*ocL�H���� ���櫶���˯1����:�t�\מ&��I���e�s(K*Vo΄PƑ��QP�=��L���7��XB���U{�f͋�m�@*7�-w�~��y�ƈ�2�n���*�|�g~E�q�����ȵ,����$��%;�>$���[�#�4fC\,�3[�%�����G�$��ɰ�꿗��P��uQ[���A�4ȡb"���������\��\��]�+<�А���"�+���C��ڡ�50�*A$�CT� �I&�t��䴢�l\���|��q�g`_ˊ9!��{4��������FA#X�Z}�|�E�I|�Тc};d6��zԟ�jL��p�pDZrJ�ޑ�SGm�s�#���N�/2��Vj��dH��j$�,��?�R�I�9J���i0�ޜ�g\��!�{��B��=?po���q3Bi���2Q>H� ��JA�]7��k��͢0XW:�e<*�T����Aփ����q��sM�5U���t�ZW���uFx(�{��""2��[�7{Տ��wC!�&|�.��J�����Q �l8<�~Lmn�br�X�{�4����_}|%P���ʩ ���>�+6�x"}�}���5����(���ͩJB2��8����P[r�;�^��;�.��m��i��#�P�1���;J�b �n�t����n���fQ��NF��-�,�:��̭C�.R��}����hu�J��a�^\�A��t�H ˈ��Gߌ�}�)]v@�@��_5v���v� ;��%��_��=�Q2�;b��_Ɖ<���hU�w(���K��Jc�߲g����։E�l3�X@��#��6������sv~4�:�}�~�Zɒ�M�5k�*4��P�Կ���;5I��9����؈Wj���d�j.D�t |���V>��P����T��u�]��|BG.nƗA[�빁��\>؞E��Dߩ����28ܣ��Gj|B���پoAaϻ��a�}��=��v��;����^TA�9��O@]k�>��8�)��5���V��0�A\�g=��l��-9�x��t��.}Ȧ�+j��y�j'3��Vui���漋�!�Y����� h��{*Q�����^c=p�r����,�!�(�g�?�ŀ����IP%��v����ǭ�rAeL����ES��i���˻�l\M���+�/2y����BZ1���9���Tr�.�k�^(��-ѯӣ�����u���N�f����GJ�u�SA����o�Ue|��7 �⽦r}�&w�W��R��$�u��7���|3����6,\�o�����j|��E��lf[C\���4,�g���t��*��Pj�7뭐N&��#7cFc������8����/���*uw<e(��R������e��6�����gF�ȏ�����d)�V��)
Behavioral task
behavioral1
Sample
e1f63d76e3f1723853a83d532fa022e8ebe3ac25b141201c8776ee72c6af7917.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e1f63d76e3f1723853a83d532fa022e8ebe3ac25b141201c8776ee72c6af7917.exe
Resource
win10v2004-20220901-en
General
-
Target
e1f63d76e3f1723853a83d532fa022e8ebe3ac25b141201c8776ee72c6af7917
-
Size
540KB
-
MD5
0036d4640aa64924af4fd589914af740
-
SHA1
8f78f8f2577e2e51e057a7749323896ad56f0534
-
SHA256
e1f63d76e3f1723853a83d532fa022e8ebe3ac25b141201c8776ee72c6af7917
-
SHA512
55448fac31f9220901f7367417e1c256f6e082b77d8db60963d12b0b1a77e9650f166a939ac52ad3613525ea896b585d226de79c0282e222b411c81e2c177e92
-
SSDEEP
12288:jhtz3pSN90HxU2Y85B0k2sSQqvsq8zjY+aK3mVK4+9qZ1z:pSN90HaFk3SQqvqYtK3mQR9qHz
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
e1f63d76e3f1723853a83d532fa022e8ebe3ac25b141201c8776ee72c6af7917.exe windows x86
f6b25597879f2c5089e9a09b835333d5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord520
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 306KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 524KB - Virtual size: 521KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE