�1�;��+������8�e 㨔�*��[��5 bX�k�����2�l��[��`.$ir�U�����C��5=FNJ�����0�cR�c��*i$a��}i|�O�ɝoQm��%�#9cnp�3SBs��8��+�N�f����_�OV�v��T��c���Ѩx���vB/ߕ�L �q#�tz�B������x��Z�ύh ��ɢ�'.�x%�xq@�Ah�k�Fh�x�q�D �Su��e�t�x�Yi%���.��45�,��A �3��^�����U����-�sO�W��6E��R��O#��@�q���½,A47�U�o$>��bm�PC�:A$9���p�g61�r%�n�8��H]��vO(��G����M9��6�#f,>:��K>^J������c���ѣ�,~��\�T��D۴%�$'��ȓ�+.�Lꋶ�d'�SI�Ō�t�_�'iL�!&��{h �� �@�!���(̤��f:&�sOø8�g�����hk����Z_�,|cEt��O�#�>���f�e5�g�>���O"�j�医�@hL-O��,��8��M�H��]k������Y!�9�E{�}T��{K��o p�:}�g�D}l��;�h� )%�,4o�B����J_�}T���dK�7�1Ww���� =?B.�C��G\����F�p����=���D���� Y�Mg�Ӵ$OTo9Ml;Cwn�����������暂��Q��#��]�>����.&�N���Ai�( 6{j=n����ZN���t[˱ T�*Gz��Ґ�3�?����������1�7G?zY��"X\����K�:�딪ۦ�D"L�G�G�V�z{aϗ��q�)�MX1%���>�9(���>ܖ��2����2�;E��x���CU���OS8��K]�)�>�Ҋ�D)�iЈXsW�~&pך�D�OA��|Sc�+.� 8�w�w�ЃO0����^�'z���� B!|�pwi���5�Q�;�`v�nQȗ ��������77�h1VPu����n4r��0��y=C{���G07�+X 3)b��]��^h��<��馍E��A�M}W\�W���ϼ��X����lqPD�=���Z�Z�M� ���U� #Y�A>�c�)_ϒl�G/:���C��F�K'bѧ�m�;|ݟ�Ƕ�̼��֡�ĸזu�XJ� �^rLI]B(a�įg�AA8�L�����A�]B���93"�#�%%���>�ha^SO�n'~m����6`ב?�!�d˭�� �xo��e���q�վd0T� ��-��o�(���߲`�q��Q��i����j�m��l8e�a�ts�]�i$;�k��.�G�z��;]��P�(�9�>��J�3ۗ��~��?�e��0�� L�[����1���~|� �W��>!�`T��p�]s���;V>�,+A\R���\���'e��8��HdQ�z�ĕG�@�|ܷ��6Z�C��J�8�X��}Ƶ�Ѹ��$���\t��`B�)�ZT&瞿����eb�E[i�\�[U���X�j�\�n6�l�� �,P�4��7U�s�\Q��o���D# �l#�+��a4梄c.�Sx��b�Ļ~���I�V"2���v��-�\峒s C;��t�}�U@.#���v")?�c� �3�'�w���!ȵ�p{L3sz������v�_��'��D_f����2�^KH$c�fGM�1�o����(�u,I��ib���9��@��k��ㆵo�����H���N��� i��e�@�����"[mΊ��Qi r��٠�@Ў��|d#��p���(XT��W��'=@)f63�L�Q���l{��i�Sv��4�q䖘��6��¾.Q�({=�!������l���mW��q�������v�k��(���s�~��f!`��Z�Ӽ���1��>�?�Tͳ^D��;mV�d��h�>̐�?����By�� ��&��j�h�ZDKxPln�N�"r��О�m/�C�ŲdG���6D���:����D�8kns�Gi�BX�'���f�&m1�fJ���"��� ꯐ�.Y��H�0�y̋���c��pr8��_sI�;u�7����CL� �#�\���R����%4��Uj�CEx�7�T���ӻ|��t�.9�n� qi�?� H�$�� ���T��#E�.����U 4�p2�`tHF��GiL&�R�R�RX�W�!�����e���Ր��ݶ��BSw7g�3zT1�(A�}o$����C<U>Hh!x���)���#(̗yc�6��Pj��n�n�B��Q6(D��e��@�J��}s�/�jG�$��@���e�p�T4��L������<�0%'�fy��d�ͥпV` *��/�C{ueP�W8T �zl5%�ū�������K�r�Gj���J������~��SG�Y*���+�@��,��LJ���7�n0ϖ��n�!w~/pZ��Nagܸ�ؒ,�\r����gz�`������qT�[\�g ;��W����\NC���a��Ӷ�-�_x=�w�d�ڃܚ�м�ލ>��nARY�܂�L�S_妤�@l�I������l�[<L��k��~�O�]�\Z�{א&�,�P����o��ʠw1A��XL%5�T�d���X��^8٘6�z�G+��VZR�ב�o���P�~����%�oƂV>�K�/��F�!y��� �"zπ�{�đ8�ȇ�Ȥ��O\L����w��r�?{�����)n3����jhR�"p��~h|�WZ�ҡ��_O�BEՑUm����<�r~�������\Mj�T��쐷��o"¯G�=�кc�+�5��.�"៕H�(�V�e���rw��@-e/�5-�9�2\���A.��QN���Ů���9ɴ���|N�V��B@S��|��Zc���5E�^�Nn"� �8KP�N�#�����pP���.1'=T_8$����-.{����9� ��1�L Ü'�ȿ'��iqr���l�X��_9E㩎Tn3ص�_�My!0���TQ3]<��G _k����0
Behavioral task
behavioral1
Sample
436b35725b7efb9d8c72ef4181dd7f7c776f93a9f591e5c6433f3c4cd7f9f8b6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
436b35725b7efb9d8c72ef4181dd7f7c776f93a9f591e5c6433f3c4cd7f9f8b6.exe
Resource
win10v2004-20220812-en
General
-
Target
436b35725b7efb9d8c72ef4181dd7f7c776f93a9f591e5c6433f3c4cd7f9f8b6
-
Size
401KB
-
MD5
2268c5c81a7bae97496dd7b53c57f4e8
-
SHA1
fcccb367c5bb81142523ca8ffaee009f5964e0b0
-
SHA256
436b35725b7efb9d8c72ef4181dd7f7c776f93a9f591e5c6433f3c4cd7f9f8b6
-
SHA512
5c7e504dc75f10f4207153954b0f0f62e8cec31a2d1c70d6dec679c48c0a05c50c6a0297aa3ed110d6e0a8e4e00e3ed4e62194cc2073ed56ce4b0cd5c025d152
-
SSDEEP
12288:j7BaLMVUAxVqANJ/m+bmBzHnoaKwzcKJSY:jsoVvxUANJ/2BzLPSY
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
436b35725b7efb9d8c72ef4181dd7f7c776f93a9f591e5c6433f3c4cd7f9f8b6.exe windows x86
819ab2565e0eed5d340c6a8ff86012d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindow
advapi32
OpenProcessToken
ws2_32
recv
Exports
Exports
Sections
.text Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 381KB - Virtual size: 381KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ