ՙW.Y��*�(��d���HK-�u5�9ͨ5*o���d�?� �-���)�Rc�h�c��q��Z���> ݪ5+�����8?�/iJ���YL��7e�H��CᗦG�<tz�Y���V�a�߫ܖ�0"�BN�e�2 /�����L%�`ËrT�U| ���ٿ� �������F2� ^_� ����:��ׂ7=sIC��L�Q�>�9~���B��}���)3�� ���0�R��k�� *Sjgg�a�ۼ�?ń�@��7�Nj�$ځϰ�x���K&⋌p.�o�e��$[J�r��d*�}�w��3V�����[�m8���k�}m�9���5�pM\��B����X���i��5.Y�L�I��JqdI�[���K�(*�o�D�u�`�S;"7qXZh����5(9Lg�D��A��8������k����WB��8�t �oi1��>�����%��4ur�^j���ސG� J ���ɛ�-��K����~�W�ME����@p�8sQ�#)e�J�s ����m07xh�:����%�x������ʠ]ݣҤC܄��-4]��/!6��3zfY�P?)l㜟3f��<�5��ì��gH�QK�����4���X�q�Àu\�2'>?N��R��%{�OW�TZQ�i���b.P�j�5��cP��9啖h�c���j�*��z�ɮ�1����t"-3XP뿗��V�� �ߠ�+��{%}��W�~B��f�i�$�F���_�m� 2a���6��S�n�eqg�Y��A��^x�u3^�~���'���K�k`����MJJ�;qKU<a�3��0����!���`6�#� q�]]]���$L�~j��0��ӑ��*�墔�J]�a��c ��ޢa���`��,�t+]`�C�oBE�l� � �,5�����e9Q:mEe!/��Ch{�@4��u�3����;x 0���㿕fj�ɜ^�>o�4r�]�us� ��hV.��X>ԍ�`7��=}��su���)5!S-�l��K��Q�Kb6��1qn{���' /�^p�5��?�/���}<i�[�MG�>9���y�LÞ�'ra�j+���2U��1TC�"O�C���{g�x�H��=��z�~��u��6���M/e�r"�+9���SadF��r�j�R��8g���0쯈}d�E/�n�v5Gr�;p��?��Z}o����.����1���B���u#��帗ݖ;c��0V0�'�t��ު��H��6�zw�/,`�:GO������_סt�8�Y���D�B�H��C�8J���� ��\|q�Z���V����ϴ�1n��Q�^�U�I�����|ћ�z��p�6��Gz��rːbL�,�j/&�o���l�4�\[����xEsG~$��E�����P��ʏ:/�\0~˴��l��c���Q����ƈ =1��,\V���qt)�w.�`{��s?�|<U�/��U����.\����T6� �m{�ʞ&��)�=YA� ��O-4�B�_�ၟ�>?9guA>� #6U��$����,�� R��>�|��m�p�͐�o��jx$ͨ�_��>�=�%�a���Hs�d'�C}i_q˖�P����}ħ��<���������V,�H�Ln�Yʡӕ��h�B�Sl�'^�7g�KaLq�]�Yu��N�6��>At|�H��VNK8�\����A%Aې�֓��es�~����SI����#��I��������a�����F#{c��[,89�ĖI �x�8�?��Su0hN/�� 8^B��\V�^��I]�� m��V���VΞ�dz�D˥'/�UT�%����h�V!X�ˆ���f2H��{�6_9"s�B��#;5ʧ� ay�m�& �u:`�b��hQ����(;f��;��@/�Կ��W�V���zjQ{�7Χ�K�Ձ�H�j�$��pz��NF����[��I��V��!209R���0�I����#�9��m�D.A�y�����2�P���JZ�,�P\� ���P�m�H!�e��J�_ t)_O�NN�=��z�?���\� ��e�(ȥ U:�f��~�t�R�{9!M�k+���_D�l�j����Or]�rN^GuM$r��j��3�*My�Ǽ�н[��]��ق0�V:��^�)�jF��a���y�jY�\��-�\�:�Ws���cvX��Tv�$ˬ��9���G�\18(=�;R�������w\ƒ�Q2��{e,� �l]���`��Աw)OpR����v�.k��s��*�_��;����^�� ���~����j�v�؉`w�U���/R<������=Vmܬ�;b}A�!l�Б��*k���xt�d��_�p��T���ਭâ�P�_�,�G4Rڍgz �Ndn~o0�?Yˉ�����&�s��"Lg�~��䏍�5.��yJ���1�/�gd�fẖ+��̾p��S�����+�|U�3�)J�s��H�\�E2��Ad7�i���CLfGX�鮹8��U���8��0=�̥��/Z��'�c��s βn�:R!�����IZ� Z(/s#A�rvg��-R$[�A`N2u>䴄�����K�&v����9�|cK QEZz��L���MAl����L��7c��1j/���������-F0)��l4���yK��l6�����,�51�e�T��Dx��m욦{�i%���̸�[�F�[�mt��'m7���1� ����%�̎�q�3,�y��@&m�ʦY��S[E/�h�u�Erw��.{ �;�i�a)������U;���M�mN�p;��<��&T��{�Pyͅc��`�[6�YqJV�g�z��=j�*�Z��#�J���ʆ�KW�}�� *��)��Cm�I���,�w�GjPր� Ƣ��ix� �ө>��Im�x�"ms^�v���;���b�jJ?�;]B��=�H�j��M��g�11���`�2Q<������< N<48�;t��GE�wU��KvIE+�/�K���c�G��=/}��l�ii�V�g|O&]�6ٷm�aD�Z�8һ�����ہl�~�^ȁ�-a#!��y]gz-iە�>�c�
Behavioral task
behavioral1
Sample
19efacd55789c4bc0fd9388e82c8119f531af9db2d1dac0625afb7d41f960e50.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
19efacd55789c4bc0fd9388e82c8119f531af9db2d1dac0625afb7d41f960e50.exe
Resource
win10v2004-20220812-en
General
-
Target
19efacd55789c4bc0fd9388e82c8119f531af9db2d1dac0625afb7d41f960e50
-
Size
552KB
-
MD5
0d7e21a803cf0f687d0fee68184121e0
-
SHA1
ee3d693bbd7f164534819eedaf238f2053d0215c
-
SHA256
19efacd55789c4bc0fd9388e82c8119f531af9db2d1dac0625afb7d41f960e50
-
SHA512
e0c1d2f3bce10af46594bacf9cad43dd19932480013f8b3fafd4af0ff702dc8e77e2d6e933856774c0451268fa55bdd5af072b9e2391e90375bace0a180eacca
-
SSDEEP
12288:m4pBsJ383XOwnr5yLpUfKsuF3iXDFnCJWi8HI3:mcBsG3+wr5mpNWIJWiSI
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
19efacd55789c4bc0fd9388e82c8119f531af9db2d1dac0625afb7d41f960e50.exe windows x86
379c428feedb3f7a00ce87fbe3212579
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord587
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 536KB - Virtual size: 532KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE