ո���ަ�}"��C ;$Ż$5,�/� �����}�!5� G_֏�ո��m$JȈ�v�E��|��!����ۧ�����o��:��ȁ-B%?������z+�=�Jt|� Ȏ�h��Kh=`�T�ΡT�F��d�E)�W]~T�K��7��ѓ,r�_ d�]A�V��b��/K��e���aw�M'�_̠钘�������z�����b8�ёm�ݍ\#<b�֒�e*EQ�(�B�������kw"��x����SX I���$ffR���2�Z��\� ���W�1e�n��@$p�֦ː�n˦ 6�ݟebW���V���, _��[���R{���^c�����ú�����f?h�G\�%�'}��n��y�(���'�D���q��9Su3��z���k_�{1�p�� �^L�`���a��Q*ڰ�Z��Hg�������'�N���`�U-��ҥ��G��}q�8�ɯؿ������+8P�2����%�Y/����-?m�^��>zU&���������� ��gsP �urt�t�Lc!��7�{�M'ט���f����E�뒒�?�vj<�Ck�~*H�#�}L��Q�}��w0��o;-Xы�M�m���6/t���3[b�W��#�L2Z��O�N#���N�i}� �B���ϖi#f�y ��g�&�}�ֆ�m�)H*��D7�o8��"_o+S�A���ψU<��N���ԥ}һڢTsӋ����`���腆ʳQ(C�$��!X�`����6���n�]���*��1�)X��f��&� �e��-�VS���6�Zw��(T�2���t��P��A@t����QuY ߬���܄�$���\�A�������^���S�}�����7f/�5>�d�<������v�"Ԫ�%��Z�I��=��>����<�;�/ì��� �A7�����7�9��%O���P�����>kn#�*�m�����h���(�2y$����{x2JF�W�,h�ѯrq1^�@����o�$�Rx�y�A��I�e�:}B����R:�?��G;�c�������L�'y���}��Y%2�'�+����n�˰���^�Yzzsշ4J�'Ǚv�05��*��1ۓ������������ί$��˞uA��Vs��J_27�f�T�����8�l~�wN��}4�e ��W��Am�W���-2��;�}R���9��{���c�g���?�x�/�<ڹ�0��֍����YF4en�.�i�A,ծ,N�Mq. �[C�,�7 �A���*z+��?e���J�iuL+ ���b�&q � ��z�h ��� N(:@�q�.�h�~ʇ�������Zl����en��y�M�!ޫpU8����L��OwŬ-d�)��v6렩TMG��n���q�K@�0������vk��9���`���r8������6�������PlX_5����,��R�����Q��G�^�����he��y�pD!���*X�6�A!S�p��:�jȏk��E;���Z�J7����� ś���C� P�װ�q� ��cbfM��/>����U���~�c8^ �U�$�j˿��!ܑ���E��ng�$�H�S�ڏ���X:{�<W.��<���������P����<�0N�}�/Osc�F���Q���SJu�3 !]�����K\N��!�6�?���Y=��#G-��G�a+�s�+���jke/mM>�2I_��*�s=����n6�6���'���I���\�v�F���:�O(�lS�s��&`u�^7g��Rh��4��+K��l���]$�%�a�І ظ�Z�u�"�|T? ��`�4)�Z�}� �gGTP��Wh���x t�l�� ,�Q`���zx���;�>S\g�$�}����(��O�y�,s5&?�d��!���e�XZ^7\6��# �K��m�-�����Rzg�۟�ov!��tO�!���S�������sڇ?��^*`]�'�(��:iB^��1 ����d���BK�:�;0Uw_G�gW��p�����(/ׅ��Eq�Z�����5}|��x�"�8��8��AC��7͒��"E<���}�<wR�,\�=nLu��\�v���;��N�f^� ~��h_��'�:C��?'��ŝ�� Z*�:�á8���5G��YY�^N�Me���r�cB��pf����C��T}P"}w��G�݉��^�mζ���7 "X5��FU��h���z1�EO&y����^�$N�;��y�vV�YK�e/LL�GB赃�� (���P�!'t�i��>;���E���<$̂����'_��\R�|2}�a���&|��K�� ���Y�G������9�Q>��b�K��]�q�;7����ůPo[�x0sa����4p�YL�'��Q���%ɚZD=�>J,5������H����8� �4^_�s�yM���.��N�Ã���9�aVF�t/H�����k�I_�Q�-/V�T"�H�J���c�M�Q�Y�7��6�Y�iX���G}�<7��q`�*���3�ɀߪ H'��+T��G���T������Q�<���WG[?Mfq��8+ ����I�&��R�]%À�Vf^.��x�¨�6��i�~��a�v˥ #���߰��*]&���#�����1z���F�q��o�ω�Cv��3����5Vb8&�y����`��'� T}`oPk�b����>�~�չ�ʹ�t��?�p#?��w�R[�d�b M� ��E��;�ܜ���;���6�O�����k�0� mP����h�����gl�OԮ�"; �AމF� ��ԟ�G��$��(��Er�be��:X���9qs �_���#�I�Q�6�{Q!�`�$|D���B(?����Ci2�����>�n,{�R%X �d1{��qb�����0.%�k�@�`��"tҒJ���vie��x���j�c5|�#y�=���[��E�h�6Q24�[��@q5 ܴ���i���5�>s� ���r t�OUs�
Behavioral task
behavioral1
Sample
dde7c744b99718c4b0fb75e321169feb97021a15a628f28c9b3ae69c1d3fe3d9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
dde7c744b99718c4b0fb75e321169feb97021a15a628f28c9b3ae69c1d3fe3d9.exe
Resource
win10v2004-20220812-en
General
-
Target
dde7c744b99718c4b0fb75e321169feb97021a15a628f28c9b3ae69c1d3fe3d9
-
Size
136KB
-
MD5
a10fbe49d0979b6bba244ce6c08cc530
-
SHA1
4cf687f3f4622ad5eedffbd61573984d97966188
-
SHA256
dde7c744b99718c4b0fb75e321169feb97021a15a628f28c9b3ae69c1d3fe3d9
-
SHA512
a9346c2681be6b82f21a4906d7cd06da3878ee267d15df4d4d6f6d40686de42247639b5a3dd3b0f07570e6e59cc218877c2834393ee56e8527b69448e27fcfab
-
SSDEEP
3072:rqwyG/7owlbdLjI83+zdH+gKEtz23ltqafys3H:rJ9lpjuzogRtq3Wax
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
dde7c744b99718c4b0fb75e321169feb97021a15a628f28c9b3ae69c1d3fe3d9.exe windows x86
d24669cc89e054bf8e58f33ab2990870
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
__getmainargs
comctl32
InitCommonControlsEx
msvcp60
?fail@ios_base@std@@QBE_NXZ
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 116KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ