�ԓ���s���0�٣���G������hCB�T1V��b�So���h���2!֠rcT���X~��y�co�y�{n�~p��F�d�9�dS���D�Ɲ�d$0-w���I7���JZ���`M� H�6�C'2�`�n�s�ƱqR�5�ήc��V�������LH|�}��Q�G���Q P�g����T��TR���6%�7֎J3�V���ɋ��W�T�뎢e�q`ye}�wi�|B�*@_l�~����0[UPж�2��Bk�M�Wi텋.�{���M#Y��/ ��w��U��y͵]bW�oç�[����wAY�ධF�?����{&�|�!8]��p%�ړ����a5x��`g�$<�?F+kyَ�����1���ګ!q� -[�>P��(�܍���X ��1Б��В���5Uը��GFɭ�R-V|n�8��Ke����͉ �g�7^���������vL%)�(����_��u��ؗUY�_��h����o�m��% )�t�q�g5Ή�H����<��ЃT?�$���U�n��j88Z�OQ����q��<��B3�5�}]��'������q���H�R�l�E����+��������k�Z$�D�|-: U�Mz�1O��oy�sZ�)�� M��]��9�{)��AT�ᯒ|ޞ�7a�.7~M��9̃�'����x�N���)Q�q��0��y��:��u����B��������9�� cb����1��%2���I�2tʋn:�t�7Wdp�m�|n �G�}X�X�P�����������K5���Ы)�_��Ó,9�ߖW1�#l g�����*�Y��!�E����o��y�/�$&A��[�|}1u<P��k ����r^ˌ��Tj���N��7&����>����l9\L^���gQԪJf��o�}�Jf�5���\O��N�lؒ�����A���=]S�]=�\*��❊N���V��i���?ƣ�-����.�Lh����%zҮj=�����Ȟ���y�@wJ2�'VM^�%+:E4���XI{E��튩^*4��k���S&� �2�n*�d� ��zp�gľ' }H�NS�4�h�נЋ�bDq���g�CD�Re �]���>����u[�wmN�by#ͽ�{�����|<M��<�>�c�c06x/zQ��q/�<6ˊ�iM �v�e��|c��Hq�ҕ��8k�����5ʎ4��v��[/��ӑ9N���F����W�>wŚ W�s�=�ūlK(���Sh�B%s�ƙ�^~Q;P� �A������u�a���|O$>_5�g��پkY�Z�lᑰߝh&�qh)n�Y�b�ϟ�cGj�0m��6�>�9��CM-�j?~f�(�'+BBe�o(rCR'��Amq%����4�pk�9���iv�JYm^vqR=!����[e�A�#zU0"7�(d��E�}3��ٱ ��������ތa<�^{��f��FJ[�Ģkٝ.��Na�e�8���[������ve�3G�lIJ�?P�c��l%i���n��:��E�����C��~&��d~�'���$�䩦[��&f�F),O�/���E����PLi=��bI��H�@���i"N��=��egO��fK������q�F�M<e����؛�Y"έ����/��ӆ@t���c��x L+�'9?*qָd$4��0-������m+� �g�Y��ԟ/��ޯ:�����1���wC���[3�@�;-o��9i�������8���R�/���*a��i�W�PQzl�xatg�\}�e��2$ഞ�8����\�:�~��v�� �<��H0kO]C]uu!��q�·Z�"���|�bJp��3�����T��(FcS}�n�JD�Z�[R@^��vDUW��k���I�v4K$Ka���Y�$w����9��K���q/���|z%_����������y �Y���1c�4�m�]*�|����0ga��O�"���S�w�C7U�X�/A���� ��u���6�vjTѺ]v�%$ �-����ͰjuD��n��]��m�T��Tnq5x㨚>sE�d�z�7L՜%�S�r�+����~����V��O��%���aݢ�J��'"��xC�5�u�疖�=��v�{�G��iX7������vI�%�p4r�7���G�~��_���.�k� 6�C��M����,Rt� ���=gY*�Cd �A����ʯ.��꼻� ���`^l��5e����_���k0�fT�l̗ޓx�D��愭�ei�odc�ԫsc���6)����xC�Gй*�<�P��mG�0ƴ����ܺ��s�d��)�d����Ӻ�9��0���i�#�|�L� �+g܁;�Mcp�:qza�)��h���0�X �)]C��oXj2�?yE��%��A�+������Ec���m��y�gb7����囉R�ڪ§e@����V:�C���t<Ǯv��k�2 q�^����`Ξz�{�fwSr������s�<�I�� �#m�Pv�e���گ���<�^���&.n��Gm��^]�!�\��! ����.$0h�i0^q�O�!�EA�1���Z���A��I�*�%���Q��q��wG��)��QVQq�w�����|z�t. �D�q�}����V��~��\�+�Bm�4^�Q�������<5�R��sP���el���I�=�ڙ $5��bF�$��%vΎ��\�I{�t(���է��3!�;0�;0(N��7�<�dz��s�*L"L����_^ LE.~�s�l!D����x�{t&��&�V�u�%�-�@�:�#+8�Pʺ/w�Z�&�*o������� �vO��8�b~��Pݼ=H�5��nB)psʠ��~�t ���o�Xs4eH f��3��?�����Z;��6�2�2<�Y�w��ȩ&��/�@�|��a���mr�MF69Q��bd�y�aӢ���pKTC��`~����=��mQW��;&MǼe��m�ǦQ� CDP�vɏ��J_M&y֔�U��`'�1�-1+�?ӽ�"������ۥ���PLG(�5s��y_�`��ζ�
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220901-en
General
-
Target
tmp
-
Size
8.0MB
-
MD5
377686eddd4652b2be469682acdae861
-
SHA1
c0097e54912e10018fa976413095fb2aa9fed95f
-
SHA256
9f90643c162dec0282aaa604ceee8c1cff9258e8dc75ff15e621d9765bff6655
-
SHA512
9c844d5836e77cffb7a44173ba457116d27f5051134ef343c905d762c4cc9f359d9927c96443faf736c490a8fa43ee714beb3134a7edb2d67ceb2e524e9542c7
-
SSDEEP
98304:sFqqFsLcJTwVSPgPsT4wril0LQDjNwa6DcxQhIQPyNPLNtKC/DpN6vPZn2yalKOw:sFqqhXPsnyQDGH2QmLNtdLpgZ2yaTP
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
tmp.exe windows x64
a9c4d97ca9d11868cbab689cbab0ab8e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
ntdll
RtlVirtualUnwind
kernel32
GlobalUnlock
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ws2_32
WSAGetLastError
imm32
ImmAssociateContextEx
d3dcompiler_47
D3DCompile
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 699KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 981KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 8.0MB - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ