�n W��R3�)�5�u$<������B.7ߒ����U��6�<�����B0�1t�fU3�v�ie�.��B�d{ ќ���9�Ř�Զү��� x�����?h��VR�b��Y`��ٚ�U�͟��'��C&#���;�3T�hE�o}${�;#���_m�v��{��`����%S���:6Ѯ)%�pC���;�d��v����9��5G瀆t�M�)z���!�y��{� �}yϮ��qRw��Ӯ���z�c�����n�E!��Qd����Hy�yL��'a�tW-��)rj�E�G����Y�Я��J����GJ�(M��ˍ��yep���t���@r#����4�+?v���v8v���6Z�W�&��Fx�ʁ�)X1/$��Hv)T5/)���3 aԭ���b <w$\J�<��q�y,l3nڵ�%�5Y���RV���/���rl����1�5|QYq���\�e@��~-a��Sa廟�t�16���ט &��X�ݠ^�Lp����w�HU��y��%#�X ;�tS�FJ.#���'vn� 7��t�e�hI¯�`�=+A��`L���٘j��Wm��t��%"��0Ll�殰��GD뮚��ϸx�뎈�[�y�4s�`����>���t���!���|���N�_�4����,�BY"\5s��������#̈���:�/�aw��kj�� &�/d� E{9��dB��y� �k}̃���]���C��G���v����Ͳ�߅2R|�Z.� ��?����VT̷�`�Il��~�� �V,amò�`w)DoTY�>�C�D ����O����Yop��x��f���D��d��*&hԘ:�r-�~I w����B�����J�m�\�+?f�5V!thݦt �Q(h�5�a�,0���B��W�s-��:�8�'�BjY���vv�N1 �ʗȩ��XBBk��1����(�ٕ�]�=<[��� ��J�3#b)�3"�]�k:��b�O4L�%��Y��$.Z��E�&��Z�y��;K�0?���e �͒��F�h�҈_�վ�.C4!�`�)z��=����Y�TN&u��@�����n.�`T�x�<�2j��*zb��:�00K�OG5�h�U;����/���Q��"~}��2��l�l�l�`���U���>���5�Dt�;�� ��;���3��!åʻy�b`�!x(d�1���/��T�x(7(� �M,]��N�Ng� "�~�ya�W��=�8M{�N��)�z�h�Gw����fW!�Z ���2P�S��oZx=�9�qu}A�T3~���m*�����K�U��L�H�����x���X!Xi��[Yh�_22$/���y��]���h�L�BǹbH#��^]S�ٟ���j�\XGG �N�wrqU~^\f��~#��_`��~櫰y �����"���>��{��]�H�^-��#��1+jK"/Ȍ.�T����:{��}WwΞ�؝�K&��9_�+ PuQ?<���,��/ճ�0�S.(�=��/�qg:ٿZ��)��7��D���ñcR�ػ�ǻ>[���h6M���l� L����?���?�c�w0\Mޫ�P���H���?������2�D����ظ�T+y�.��v�H�z���oE�dHt�H��2�R�i��D��gg ��Łլ�ǧn�DZ��zJq���g#�$w�x�q2;P�l@h��5�?�����ʆ�,1@����WZ�tV�-Z]_)��T*��(UP���d-K}��+1sQ����^3�t����&���N��H�Ѐ���pi�f��y��05h�X��8QXP���7^�*m�.01����j�. M�FU;��_+;�rdO>�\��+�f� �j������ ����*͠�� ��r���vAO�V2����`�;p>�U2�.y,/����� � �W����� �F��/��z�B��j�Q <$�c��33��]Ѥ������)�:}_��oW���M���*s�3(b�@>�Q^"N��b�>���v C�ȩ�u����)YYL'����dSx�Z�CߣNN&�R�������?����*AQ5\&ɽ��~l�4U)9\N�r������e��K���x ԌST�����t|6ݛ�� V/P�E'��>����A����� 嗌sN]q;�V�E�+<�uY���^zo��gX���5�BQ��?:٧��ߩƠah_�D�tA�b�p�o�3=��b�f���g_S ��A���qMy����k~�f*vF�?t�{�bC�N���`Ĺ�oSSѝ��+�?�վ�3`e>2= ����w�����'QZ�d���vZ�e�U��#I�ק ����I%�c@��~I'JN�$3�w �/��>�۳ ���a�̛���E��IVe����-Z.+���N8��ך(�d�Q>*��8��fޓ�z�ݥ���p��Q��D���H ���.�=&� 1���_���ѯ؞���Qے�.�?��G}�u���;����4��n9p���3Rv�����/S5����#J?3n�d�����|�,�ñ([��_�r$�n�A��+,�*n?���7��J�f0�A�aE ܹeQ�)��#�ϋ�P�@!1 ��GP�k��Z�~h�EF���Tp�`�Jт` ���(�BG�2<�=3egŕ�y�fʉ~�����}d�28���h9?]��7`����R������y�yf���K�f���7y�x��lF�1IM,DX�<m�2QG���$�����&_ӑ-�<�{�L�e ?��e�S@���9<�gA��9Z���KY��U�(K(��dAl`���A��&C�(Id���YD*J�Te�Ĝ7��M���$;m�|���R�!�y���r���r�����y���4O�߶K����� �奲�M,���P4+��.�ۇ!M�ժ��Z+��4\b?EC�.Š4��z�z�r=�-����2{�����,D��g��b,v|�Lg����|��N�ݬ��� 3���*�����3��L�zH���b��~�nF�$VrX���G������
Behavioral task
behavioral1
Sample
6a99a63eff61c8633bb8ce743032e30e0af7c35037ee342c3ca30370b74b7c03.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6a99a63eff61c8633bb8ce743032e30e0af7c35037ee342c3ca30370b74b7c03.exe
Resource
win10v2004-20220812-en
General
-
Target
6a99a63eff61c8633bb8ce743032e30e0af7c35037ee342c3ca30370b74b7c03
-
Size
104KB
-
MD5
40e1021efed4215b8fe96e1062d78cfa
-
SHA1
7ec79a9392820ebfac3bab48bc940a1cf2a1995e
-
SHA256
6a99a63eff61c8633bb8ce743032e30e0af7c35037ee342c3ca30370b74b7c03
-
SHA512
0d74e2b036320d494c2a982b013be8ecac2f0972ef1a0f284130f0555da93850fc253225f32c60d23771d24e7ae545175cec50379ff73d571a964f2bd57a8d32
-
SSDEEP
3072:u1htqsWwBHAhHllZus7QMqYmmQgPZC22Gn+:Ght9SHB7QHYmmj8e
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
6a99a63eff61c8633bb8ce743032e30e0af7c35037ee342c3ca30370b74b7c03.exe windows x86
301231b4db783fe6a6c9131188296ef2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
ord693
__vbaFreeVar
__vbaAryMove
ord695
__vbaStrVarMove
__vbaLenBstr
__vbaLateIdCall
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
ord629
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
__vbaNameFile
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
ord593
__vbaExitProc
ord594
__vbaObjSet
__vbaOnError
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaBoolVarNull
__vbaFpR8
_CIsin
__vbaErase
ord709
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
ord529
__vbaAryConstruct2
__vbaPutOwner3
__vbaPutOwner4
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarOr
ord670
__vbaCastObjVar
__vbaLbound
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
ord569
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaStr2Vec
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord716
__vbaFPException
ord717
__vbaGetOwner3
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
__vbaNew2
__vbaInStr
__vbaVar2Vec
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaI4Str
__vbaFreeStrList
__vbaVarNot
_adj_fdivr_m32
_adj_fdiv_r
ord578
ord685
ord100
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaAryLock
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
ord616
__vbaVarLateMemCallLd
ord617
__vbaVarSetObjAddref
_CIatan
__vbaCastObj
__vbaStrMove
__vbaAryCopy
__vbaStrVarCopy
_allmul
__vbaLateIdSt
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ