�-�E�T�l����&ȉ��s��I4�s���7��C��H@�����\HmE6�� �Q�m���mO_�c�_|���� �u��%]RA`C=��Wyc����j��]�w#�3�9?���)��P|B�����D�n<4.Ǽ����q�DZ�M��"|z�5]2��Nȋ�z�F��VE��d8o<�-���JBtK�_���h��7Lju>[B5Ћ�.E����I�Q5��E�u�������#�Q�$�K5�1aޝ��**��}�;?@)��q��gb�0��qZ���I�� X�x��L�T,��膻n��|j=H������3�, �ɢŢ�R�ɣ�������C 9�=�C7$�z��YnT2RUծZ3��rB�|��'�i������P"�yY�'�:ɀ��JWϮ���q(�`'���f'x�����_ϸ�r���\��W�Tދ����lˤؠ��K��BY�$�9%�<G�>�7M����pɇ(��e��l� .���8r�W��*^�qv�eJ�e���� ��/xP�N�{�ce:I�7�Ek���j�mN̞�n�.ӇR�S̫]\,h���m���PO��J�@�D���ަ�'� 7�>jB��P�.�${�Tc��a�)c��$����f�_E�f�)��Rѯ}�n�_rg�0�:˒̾ K��z�)�z鍪��G�<��g���'\z�ep]�5�tw��Q�-'�+��k>��[��G�����#�$[�K䟛�['���<G�-K��tQ�~Lʵz�ϩ�Zl�W If���Ϩ���6V"r�ĀoY2j�2�A�*�KqN�Ϸ/r�YDcG6L��[�����g�bi�a6�y��J��|s28TB'G����� �EbV�N�M$��⯗GC��`.#������)�kx�$��S�Z|ק��2ۤ?"����M��Ϝ՚�+��މjK#-����Sm���1Vͧ��?�������� e�̬P��j�Jޙ��oJ��M�B���T�����agbD��)Wt}#��CF.,a���m��:9!�=X֊�{a`:������ � �&� �� �wՅ�$�w^���NQPf7C����K �Zb���D$F�)��j;g;�L�a�#���z��ۊ�M�6����e����������_<W��ً�O����x���*�]U+SQ��)�Bz��V��A}���)b�`���Ep^H��Qs/)�ׁB��� �))?�k���ń���4���m=�T��Y�|b�2����K�=B����W�Qc��"X��h�8#|����s�����6��U�~���眹Q��F�L������V'[�H��Ej<��+3D.��G�ܼ`� ~ l>�B�T7�l�^#A��AE*l*�] ��T>�Ӿ�ط�x�s��2��>���=�q�0XR��}4����#���?h���Q�nys�.��ܴ1�BZS����l9 �y :���7��繺�_ �v������B��)[�+�+D�� C�$$����ȸ�6���V��C��"cn���R�����:��'�x�0�.���e���fX�Q�ҩ΄k^�|1<�h01D��)1⮿������YX<pA�!2h��1߫��ĨO�gD7T0</E�:ԊGя^ LU������uFB����fv]���E���v��4O����L�|� $V�� �z�FKі5��%��^m��K�4����Q����6�/_��Xʷ�\��s��N���?g����2�C��1�|J�ڥt3����� ������IG�4C����'"���W�h�I�����t���w��0�&*�|=�����cx-hn����m�lXǨ;���=�H�B�*:����(\�0D݁�}���]����7�ﯓ���������x�D<���_�0��ɛ����� S��=�s�7�&f�*�}l������y���W��G�Z-Be�Ύ�����G�~��|�� �+�P$���0��Y5�9�]��^���'*f��\_ä�m��t̊��(N�JD1��R�T�����rӭ{�.v{ꂎcd�3��(�����|�#$�v�� �S3�ڵ��θ�!�S��b�վ).3�$�;"��� �~�Y����y���z��Z�?Ga�R{��R�Z�������`z����#�����Fe6�O?.���E�S�S-�D����Et�o�n��[e22!p�Pqf��'���vSen@/��rmmu��(��X�^�a�=�g�8��A���[���_)-eZk�n� lSxX��֧V�m�"��j��=���#���玓Z�핃�%us��-<�%��az�wNK�ke睢p8Wb���_��� �\S6�䟚X|��fM�kp�A�h,�Iq%UR�{��i���ǟ̎��i�LTN[\��֚H$r�?.8<\_�ٷ�Mx<�Ů����}�g]o����?#�3����Y� af�9(+w��{���������Z� z�e��*����e=���"<y�M<���4����z�r��Y\�;�*��(���v�`��_�u-T&�X��{���UaS1 ������o=���Rwab�A� p��뾄w4��QlΥGR��u���I��}ڤ�7mr2\gf2 p�s�K�C_�q���t�d��a������BZ�������U�y9�����է�|5�G�_*`�&��<��lbmF��YAr�����#���Oj�o�b-�ɮ��¶n�W�'Z�}�@P��������B����w���v�SY��tL�&0%��1�\�v��Ԑ���M��R��[�}��ߕ�Kp~c(�o{�|L��l����[<��)ˁ��{�}O��(C6��F��Jf����Y����g���'Ǫm�=�`+�5y f��$ʒďC^��ʎ;#�JA���MA��=�����&~����\�Elj�5�š���z��~���I|<�m�^6���X..?�D;��+��)Rcs�*Bz�d��e�y�f��xՅ���"
Behavioral task
behavioral1
Sample
27e159cdd22be7d9ebff6a46086aaae2847f9f250fb2df4ad7b626fc3bd2ca2c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
27e159cdd22be7d9ebff6a46086aaae2847f9f250fb2df4ad7b626fc3bd2ca2c.exe
Resource
win10v2004-20220812-en
General
-
Target
27e159cdd22be7d9ebff6a46086aaae2847f9f250fb2df4ad7b626fc3bd2ca2c
-
Size
968KB
-
MD5
5c659a011e75e1457faa9e3f635d7657
-
SHA1
3fad6d744ce85508a6b87b57a3018b82101bf97b
-
SHA256
27e159cdd22be7d9ebff6a46086aaae2847f9f250fb2df4ad7b626fc3bd2ca2c
-
SHA512
262608a04acd07321a234e43b8b45333747d6692748fa568197f50611ce482dda6fa0297c9cf321c9dd887fad5ace4d1f41a1b5f5f8c974a65b84f6bb648ff7f
-
SSDEEP
24576:jhjjPoFZCadaGUcBrpDtJdSY0kf/UaZUUBhjK+Y:jhjjPMgaxpHJdSJkf/UVIbY
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
27e159cdd22be7d9ebff6a46086aaae2847f9f250fb2df4ad7b626fc3bd2ca2c.exe windows x86
1b21c8cf4de84287c5e0c1d52f9195b6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarDup
kernel32
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 904KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 952KB - Virtual size: 950KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ