���h[_+=Z�DzZ�3n�o��G���+��#����]�������(����R�����������:R�@���� e�~;ղ*�\c������CQ��P�U�s���#�̆�@���;������1?<���^�� yI:���椣���.�FH�9�h/�dT���4N�~fA�<K\L�z�X���\��³��g>�eP�oPJ�S� ��T�����$:�b�YAL�{|s}3�� nz�� ���b�G��i����W媾 .�c�`�TB|и��BV|+��_Y���� ;�ڟ� ]��}Z��.D W[D9E~=���jh�ʾ�zh��n�|��7�W��D�E�?!kՂO�L/i}�bl[�x]6j����NR��������WD�Ds�en�|�9簟.� ������m�CV3 A���]��Ajs-/O�2��挪m�dZ�����J|ipSm���|�'F�h;�n2�g��5Du �냵?Ԓ�]���c����|��7��%̳���J���]��i���R��x�~����1��j�1�t�+��Б�I��|v$&����;:ƹ<�����i���8w�Hn�;w��L>{�����O�v���T��M�>2����g��_nAr�?a��T���n-| r1�E��Ն�\ ����-�Bܱ����e���w3K�:�!ݐEΰO��uo?!v� wg��Tp��~�!Q ���3����$gE���8�:i��2�(C��m j���戄��(Y!d\�j�����n?r�$�y�.�����8�;o,l䠖P#TT��]g��13D��-�md�j)�2I�IVּ^Bͼ҇8^���?�%vg)�������Z�.pcI`��:"o�D���#���0)�B}d'�����N���o �\d&������srT� иHfF�.���Xm�p��p4���`�3ɩl)�ܰ�+��c���7�/6��L�5l-�[�.+��1Gi����� �'~�Nz�s��U?�\Ih"��!K�wɐ#��Q݈�;|�ߖ����' 9�E�o�A$ �y2e�u+EԬ��B5�u\)�JăW�����w}���;]x��z���}?D�*o�c&J��l��u���Y��*�ޜ�d�l����>��.4t�eԷ IL/o�4�K<d��W1#��01? �Z}���(M)1��g4�� Qe�쨋č~�]���ھ�e$@��X B�D�!��Wc[��&��lA����sW�f*&��^�p�o-^(�n�����\��.r��Y�?G�p��~�6�r�S T2>���X?@�I�%�"������� b����X����NH7�L�E���#:�q�~� i.���-������iR��@��*}��ruƪW)� �(��.�Ի���d0qLTF��ja�K���vE�z�������>dx�x�f>j�@�jQO���]Y��=�ł�_*5Wh\�-����ۈ>��"п}~ð�!¦���v�IP`�1���B۲��m�Z �o�A������,�&�Hƚ5�/%[���^�N��(������=�S�6�;�ڇ�$��LM���<��7��!$���w|�%���Hu��~�y-��j惘�2��߅�6��XcGR)�,����2hSуd\�Ftb��V{�V�lʗ�,����&�W�zbz �c*���4�u����YH�@���o��vLJ����Y�P1Z���v�ڏ���~���� ����by�Ha.�2�lv�a�('y��������$ s�wh�?6������2Zϙ����\p����:\4W"��nm�4�HQ�?���r�(��[� ��ˍ>5E�6�)���%r%�q/����/�xg.�����az�O��^uqI�=��.�ll�TP���W��;����%7�NM0���E�~Y&�%�j������VeI���ƞgtD�"�]�n x�+�oP{<Ҧh&0<�Н9�4Vp�1�~�N{�@3�����]y�6:�թ�3L��R�Z1f�e�'X +�������j ��'������NЦ(���J�Yi�B+��0#D���������&�L%��6t���8�Տv:#g�Uz�����=_h�B�s� ����G)�A6�7@jtfL�l([X�:��������j#��vE�×/S� k��p���E�Z��̸jf���x�W��UMI��}�5������/M��l�k��܅;�^�?M� F�ޗ��AeX?X#Mr$nWYV���Ja�h�tRZ���8�/7�X�� �J�p.�[촕:b2�Ti��'t�v����n�x��z�����\�zd��3�����Q���ꪓ�S$em�q��c�� !y���\���'��R������}K��/�=iy������O � } H�����g<9|^���K�Ehe,���Z�ߢ<?Q9m�&�H�E� ;�]A�j�B�����>Wz��Y�/V��_�@y�jCxc�`�6^C*N�>�^�eo^�t�<xMXs���Ab�6�\�A� �� r�\��|�����f������Z�F l�.^��ng��iAg`��d��i�u9�y�Z�:u<^���wc�S_�:Vi �24 �{M�bu&��� \6���cA},A.P��V'좟h�w� u�n5K��pB7��胸Z�I�fB(�ځ$�T����}d��,��ݛ�b��2Cza Xv�u��ٜܱM8g�BM}X�9���ִ�݁�OM�������;�W�<�N��T@v����!*��O\iYN�SQ����aB�6O���ZPZrGƤ�H �ٽ���49Z��u#H��مCQT�+W��b�K�K"~�UaSh��s������}� �m*SZ`�#������Th"���9qS!��5/&��{� PV���=��Z�-s���M(�,��d6���,��9d��b��7��[�>���.)$��7�,�_,)E9 �VUr���)��e�f�+�<��K�S&�E�p��']�u�I��jh���$�^���)�A�0)0d��p���R���&�nc�h:
Behavioral task
behavioral1
Sample
c0d4b73e0bb4c40bef8f4a37c451a846f6ea8253f807b85f29a285fad9f2ae98.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c0d4b73e0bb4c40bef8f4a37c451a846f6ea8253f807b85f29a285fad9f2ae98.exe
Resource
win10v2004-20220901-en
General
-
Target
c0d4b73e0bb4c40bef8f4a37c451a846f6ea8253f807b85f29a285fad9f2ae98
-
Size
179KB
-
MD5
27122da43c1424e1e320ccdee025904f
-
SHA1
5ba3ccc6f3b00b93cd52ac7979d021f4ea8c3f55
-
SHA256
c0d4b73e0bb4c40bef8f4a37c451a846f6ea8253f807b85f29a285fad9f2ae98
-
SHA512
c4a0d9cfed33627312c1e4ebb07da7695cbe21c101eea56f94989b2ec834b7612c324ade5f997e9a429a0aae12844db4f0f36ff7a25f7823743732e708b84360
-
SSDEEP
1536:5Ni6Nw77b62FtoEaJUAlj7N53r4QzzWUJh5f+yoKLjMOaQ/ECJlcUEHmxAxj2OyJ:2C8xMh17N5bbzZP1foQ/ECjVAxjDy
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
c0d4b73e0bb4c40bef8f4a37c451a846f6ea8253f807b85f29a285fad9f2ae98.exe windows x86
b10634a794ab239e1fbcb80ca68a8e48
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
CreateThread
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindResourceA
GetCommandLineA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
MapViewOfFile
ReadFile
ReadProcessMemory
ResumeThread
RtlMoveMemory
SetEnvironmentVariableA
CreateProcessA
Sleep
TerminateProcess
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtectEx
WritePrivateProfileStringA
WriteProcessMemory
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
CreateFileMappingA
CreateFileA
FindClose
FindFirstFileA
FlushFileBuffers
WriteFile
RtlZeroMemory
GetVersionExA
SetCurrentDirectoryA
CloseHandle
SizeofResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
shell32
ShellExecuteA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ