g6~Rl6��<}̗�SL�(!�rq�,���QS�ߵ��n�MFL)ƌ�">$�Ż0��gn��n� ��,j�'��#O�b�-6�zƳ{-=ʦ�&W���9p`����н���A���t���fq�1q<����h����rkPr�0�/� d�����oӱ�b����g�1G�v��m8�Ț:o��$#���k컒�E ���v��� Mr�F5-%�#<����R�2����|~�ܙ�7 2|�4� N4/BJ��}��2|�ك��P(�@��!V�9|��,ˠ��UP���Z���0s�LA�\���X"�����}�3��-PϹ�N�H]�E�t1���������#9]��!uQ��n�TY@I�Ė����|d��0� `���\P/?mq.4P��_�:z���l��b�j���TR���f�h�\oJ`;�2@�Ы��[���%cYH)�:'��'�<"]e����A���*I��ZP��p˙^�)�����W���(�RB���+�*^���_XL �S8�uz:��c����Z̵��"����s����B�����dֲ9���$�����DC����^�0��Ά!��� �u���n�Y��t6tٸm�[����Q��\+����ͱ��ͤ�'4+� Ҕ����7�زZ��x�\�� 1���:���B)�$=>ÄO͒��(���0�WSdCpLo�Pc���d!���ѱ����y�D[���X��h������g�����Rn��� ���f!�����ܠ��#�+����s�x�@�=N+��(���bC��7�@W�}1T���t�}]�`3��Wv=ޠ_c���^��@��Kw"��g���5�� _���;ڴ��I�U��R����� ����HF�����y�g$�ۮ����� ��ٖ��[�?J�`2�h������2��A�Ͷ�^�%T��ɘl�{�!��&��5/4E�"7���i�+M�: S��B��}���}L{"� #k�Ί�Ы�gEz�0C��߮g��t���c}kC�sa�� �^�o)L��4q.���$0����������%!��(������/�@����)��Z�;��è�i�&�pYc9 } 4��ɦ�1�4~[4���h���瘤W��z�S��8�ZV;( '�(�hT'eu�����'i�/�ڲD��S���S�A�g������Dz�3]�T��(�1�~�7��F3�<�-:���|��������I ��ʳ�|�c�n�(A`XdꞴ8��"���G'��!�´Ȑs���nj�I����8�'����;:,��JfF�ۢ��z��5��䖷��Զ��L�'����r�#6n�>�J߀���g֙�^v�)F m�#�(h p���]�Ț1��5I�ˉ��>S�U.�k��(�� ov& 1鳷�� c�G���Yz��Õ���4��f^��^ԧb��2���rl�H����@\M?��]f�Y�ƂF����'�]���d�x쉡��P�ޚ9N�"�R�9h$��� ��'���B�����ܒ{���j�ԕ�%b�Q1�>y��ZQ�Ԣ�OX��h6f+u�ZM�R��ш�G%��ulk�;���c�;>j��u����)D���p>�=i��l�����b�����꧔�L?�.ă+�Vd8l�p�^����Kh�0�3�q"��CUtT�b �Тm���M8��3���$a#�u2kE������y $�Q�Fkf�P��D|����8z%������]e���s�G�w�?кt�BŁ$ q;�*shH��@�~M��+0�������F:���A�O�u$���dk�������x����7�x ]8� �_��҃]rk�S���]O����E/��;�Le�</6)%��!Ҝ��q����9�J���~ɍ����ΗoN����"��;���\ ����[$~}G�!t�L�UBaw���_�$z�[���s4��=|�nn>L�ŧ��F�BOТ�uu&�|o�5x��1h���/B;��J��T�-��`h��"�,�Q����G����V��&���tp;��_��m��FN'� �d�|G���ঘ�x��K[�������7Qn��EF��Wdd�X�\�����~�?guU ^���U��$��$.D{����9K;�Y����]���d�F��|�71������IQ��ߗ\� ��&�l��v#�|��j&QAZ����W<"�`��d̐�߳p�Y �h26��[�����Wfs'��g�N�g�*똥�����lcw��^�]h��$�è�&췛)���(����(���K�j���1?hSdw����Z'�\���ߪ;�<n����kj3�、��R@�mq ��N��� `� ����S��]8z8�qzH�'�x�J2WJd�Z;�B��� ��=��}� �j�Dx4y/ݺ�4B�[���_�j��A�"���qvCE�3Cc�5��=�O*~��'f����!�f����[kQ������dBi���$�.����+Ʌut�%*Xg��r�|�~^wP�%� �Z��^ � ��p�(��i�3�v����e �}+��ʄڥAn��ҘQ�ِ����o��jXy��9� �����b����xc,J�pdh֒u���'�1�����8���o���O GV�� q�x�B���h��_�,�>翹��Jbh�>h��rg�/y���!�a������&&��q���%�][jU�aSJ�"�S�_*m�`i��"oEX5G�?b�@�Ğ4aB�T����Dn��TV����� $�>F�O"��0��<���8�������#|_0�YqRFm����.M��$��F�� �@[�1�Mwg������ja����Á�|�@���b�t/�9���m'$�z�n۸����{c�Mn/�jKX�D|^����R�"�OI��OA��7�ޖ�q1�bjJ���<���y��9Nk$)�����Q� -ټ�DR��U� ����V]H��h�������FV!eu�.��� �X���'Rw�l�jŵ)"E_Y����x!~ H��g�a8+���`�"�m��9�&Nc�^R�
Behavioral task
behavioral1
Sample
f16f6fa974e1362a8bb82849a886fcaab13a5e8df8e915305102bd402a15a723.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f16f6fa974e1362a8bb82849a886fcaab13a5e8df8e915305102bd402a15a723.exe
Resource
win10v2004-20220901-en
General
-
Target
f16f6fa974e1362a8bb82849a886fcaab13a5e8df8e915305102bd402a15a723
-
Size
3.3MB
-
MD5
37ee41fa2c86fdc56121ac6b5a4b4a77
-
SHA1
7290855dd784e2d40d8149783d4d015ccba23cb9
-
SHA256
f16f6fa974e1362a8bb82849a886fcaab13a5e8df8e915305102bd402a15a723
-
SHA512
e903de540d51c409655e33228c011a5bc25992633eb74dac61434f7f5c107ec76e2658ff4c3e5a302a9df36f01a6dc124411369cbb1ef9f6d3d2431cfce75020
-
SSDEEP
49152:dyFhY1yf+4TrQQ3LKq9sYt0zZWxG/ZAq8zrFyPGgqvsmJfwfkcSdO:d0YSXrQQWq9sYGz38XFyPlWYfk
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
f16f6fa974e1362a8bb82849a886fcaab13a5e8df8e915305102bd402a15a723.exe windows x86
a265a9a18ef9787457df88943ca2f6f6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrVarVal
kernel32
ExitProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ