i��9h9ug �����Y�u�G��/�?t�}�r�f~��:tϗ�}�+��^�0ޟ �@5�F���^�,�V�� ��c��u����-��˞�ˑOl�c��ў)%��w >��t�����e�����2Pn�Vf1rz�)Eu�x��λ� 3���+D�z����¸_��~�����ߦ?PFI�@܍Exhj]m�����2ǫ�"?��虜Uvw+��W�E����1v0�M��6�'�A}�a��sX����2Ơ�8��u�'����6�O�z��r�Bi����Z>.�t�3�&@�ek��Sz~˧� ��Nf~����s�����3�r�ķxY_�P+��9dl=!��{�������ok�@���#�Q#M��j�����0wV�V4�3&ŁEF�oE�3��\��k��2ͤ�ڐr���j�Sqzs���g�yas/�*l��%0���a�b������9ҙ[.�q�$��5FgA�*�'Ǘ����|�Z���tCH�9�c�@�q<Mk}�j�&�_]Iԯ���G�w;�⸗p��a���$���wԀp��2Д{/]�QI�h<Zn��=��1�kZYK�Vi.G� �V;�KR�����0��~F$����*h_Z1~��GM�E�3�^�34o��\M�J�EZn�a�~xgE &k�M@4ѫ.�d�H��$�æ�Ҕ���!����˩<�_�v\�)�Z�9���� Yc�0�� ��?���F�����4W�P�`�'h2���NO]�F��y��HP�}Nj-��_ @Q��ـVlvw�.�n^��@���69��8�6R��= ����|�R�*E`�<�0�nd4<y;�j�-��¤�ٿ8V9�s�qsa�R@����Eh��i��{-�h��v�=�T��ʸRt�c_݁����f�طoAm��P�kB*w�Ն��(+@����P��i���QO>��H��u���iwTsZ�o3R}�Y�d���go��!F�OP$�n�v�mo!���%�Rm��x}�@��W�$��7��tȑm��b:�e�Ģ�{�o��:�@)�m��<RY٠o:�wϢhꘒ��īr�I5$�J���rb0�\�f�m~:x4t�<V�K@���m��Ir��$��=f���������֚}�)�1�4��Ւ�J��Ho��K1�ye�e^�g�$ӱ �7I��hSN6�N:%�ޓ����]j�c�JbX��=7�R;)� ̧ꆟM5�~��a�����p�0I�r�@�j�q���:����C��?��X6�-=dc����V��þw�Ⱦ�����! �c�LM�`��w�ԃ�)��_�d�%>�F�1E��-�r��Q��~ڀn [h��QB#��-�I@��M�^t�w!�+*��wL����ݜ �j>�/��/���G-�Y��S�|� *��d�����|¶x/Ki{q��^�*�d��蝕���P�d�� lH�c�1>nB�xg��vֹ�EK��7�j��.X6d��^S���t���5@ �%Z_�jA�#=����9ϟ�3^�,OA9�B�Id�W��f!�Y�b���;�e�r�vvM��2�4�f2Y����K:#a��xO��#���+���������̃����怩9���T��!DʲX{�4�K���e�ff�˛J���Цn߃ܡB��N���b�g0�I��/%�v�.��?��CQW�Z�+�=�7N��U�#��?pA��5�o&��7���H�r���}T\�6^rz�����Z�^/��n�*��\��I{�Z1O�9�i)�<{o�b|���H�ɧ�v�H��T[Ft��Z2�Obë�f�P�7�~�鏢����0{�����h��͆�vt�G�Ӂn�w�|�\�m-����V&�R�=@ aU��{�7��j�S�էi�W���-=xO������J� tS��%7�������!�dp3���g�2�.>Y�p#~5�w���pv �O�E+|������dM��2<��54��1�v�Ϛ�}��,F�J� �|�P� 6A�c��a�*�@����Z ��:�j� �B�dh���ז�}e��c�q��t����G� �(�9�b`Ɨ��]�s���/�|��+s�bU6������V���2�a��W*��?���K2, �0��b�h���7֭dq{ y���In\������;@�K�Rख़ g���p*��g�˟3gϙ�%�sH���[Pz!tnjǷl�����{�f���ʧ�z-����T�ݦ�⺩LS%�w��''�R�~�z�뉏W�oh�*�BЙ��U�/�N�ü=�UÍ��M$5������ �~!?��6|��y�d��5�4�^q��]B�����v�� �Pl�����砋��}k9O}������IHb��ahE�����Z�yZ�Na�K�>s�g�C�%�3I>�R���3אE�5G�����o��4��o������c6_D�OH�e�+��}Dӧ�Hԗ9�i���+3|������5��4�4��F������Q8�>��'V 6��[���l@ޭ��X�l���j���0�|��r(�T�:v�:<�q��JS���y�!g�M�tE4���j6�����eަ��覇7�B��磣�?����dNC�ȸmKg��ED�\��\#�BUhsF���"��b�������7R!��?|����d�ue�fsB����g�w��ʘ���fPPWA6�}㼏�!���抜+y�@��`ď�����Q� �-R�V���-��M��" '3��CX��Q�����xL��"С�tm��V�s&tC>2ݟ����#8�v+��`�d7A�|?q}l��Q,-��BL�S=�#{�� ��!�����h�^a�TLw6Ђ�/П\O������(��'��H|�������!���x�c.g�|�S���Ylv�� ;�z�H�JY��D�d�9��(���V���t��ۙS�Iq�i�a:q����߹Hߏ ˝��G2��Z�U��/l����I��8��/���s�����M��1�@���cK��h"p��y3�JS��u��_F�%cf:BNd9v f���Ң�2U\>��i��-x�6�4L� &F�a��~�A)�(
Behavioral task
behavioral1
Sample
747331886e35902680efb7047d9759b498fd6237be56a1bb15ed5f19888fcef4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
747331886e35902680efb7047d9759b498fd6237be56a1bb15ed5f19888fcef4.exe
Resource
win10v2004-20220901-en
General
-
Target
747331886e35902680efb7047d9759b498fd6237be56a1bb15ed5f19888fcef4
-
Size
532KB
-
MD5
03757964d82720ef153e8483662f76d0
-
SHA1
4fda26687b6c4c8e15fd248815c160357b4adb87
-
SHA256
747331886e35902680efb7047d9759b498fd6237be56a1bb15ed5f19888fcef4
-
SHA512
3aad654d29264728385ff8a25d4ef968e54a44e78b368aef3124a3eafcb321f40248d2d0bcd9fa33fb7e53f28eec89ad89d72bd9fd689b4a6a97a0179857300f
-
SSDEEP
12288:VaxCjnImQgUNx2jVMe5bCWhswjCyZkcN8dX8QfSO5:VamI+UYdGNyHN8dX8QfR
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
747331886e35902680efb7047d9759b498fd6237be56a1bb15ed5f19888fcef4.exe windows x86
b9d2600aec50c8faa5a65b976e72ab15
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord662
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 306KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 516KB - Virtual size: 514KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE