^�}�6�L��rv5�+3Zr� �x1�/�� ��]r<D��,C8���6�t=Ա���v������g*(�r��hCvt�A��j4.ѱA)jHq1���D���^�JBي�91y����+��Q��o::�m��D�7�Z*:�����:;����*aφiʰɪ�&���$�}%��4��d/Lp�t����rI�*��}`? Ak�?}$��=n�~��������&%��V�E����=0��%)z���e��)��L]UA��Q��k��4�`�C�v %蟟� ���K�ͣ����?�g.l��~��'8���u������Ɵ�a������M��u0G��h{@�������y��������b LhS���ԹqU�Ʒ�br��ɣ��b��>݁v���%��ԉ@&_d���]�H���Y��!� �e������[�iNQ^�P�j�K)�;P��>�Z�^;kD��u�>�\�w�{ �IjN��u�a�[;7�/�J�5k���zk���I��*������������qe��7�s� �^���/�1Uwee��9���p�I�Z�$��*q����,�Ki�n�v*��K�n��Cv�����)f��k�ѻ�P��sI*���bl|I$���xl �����m�#���Y+�4Z{�9�0T'���Rr��5�_�fSy(@v����i�����yw�19I"���t�f�1<7:��'��q v_k��9P�K�K��(O]�����۽��:53������P�~��\F��y~<���O8��폭��"n>�q�2�� ���O��?��}�ڙ�F/��C�|2], 0d'/�H�=*����G��)Rjе���ꂖC�2i82[�(=� 8��F;Un�9�)��8��C���Q0� �5|Rw��:����Z��e>��I��������Œ9H��+�:��� �R�^+�@�������8�S�J����/��� L����F�����3J��/j�!&����-�o�)���D�8܀B}&�)��2�N<a��ɦ=�g��I*n��y�|�,%��UQ���k�,T����ͮOy�;��]����W�����`�<�}�W��R3rBO�_�ր���}���X�!l|���t\vP1�3`E�>�5?�����Տ c�YJ��g�c��NA��D���I�᳘�'[j���,)�2^#�I�a詍/M%��3����kő�D^B�:d�B-#�B``�&���}��uջ��2���y�1��e���W�dR��%RSW}Ζ�2� 4��٠�����AX�� %�OQ�4�:�ӧ�K�]��*]U������@������6Yv"��Q�3�x6nF�o5� �V���~̭(0�RZ�]��i������)o������O�*%���F$[�v�xIѱ�A�L���~�ԁO��5��,�'��R����=v6JiFA�j���i�~�u��#����iL��M;�>Si�h¼wN��Yq��|���ؘ�*A���d�b"�W����zuH<ڕ����/!he�גZM����'}U�����g]��/qy�=IX�hs�0]��B�$�k�J,�Du��w'�Uh"��h/+O}!��V�X��C�����/.S�z5����WG����芕��e�<a��#�Ƕ?/���BJ[�rUE�ۢ�lo�嚅���aZo�(�Z�|���ݦ� f����*��+o�u$ns%�\�ÎK'=^�2/�@� ����V��^9wiK����bir��+Y���̘�[0�e��|�*����ؖ=��6�X�������S�4B"4�� {E��%/��7��{',ņ��-C|iݓ�',[�_稷�����N��H��Qܘs r��M�̈́u��w2g�Q �"���z�y�82lpR��"�1L���&]����q��@�0�/�%0�|�)*�V���W\�!Io��|�;y IUX�g �����0_��z:�z[0�d�~� z��o�A+��;,+E��p���_1ܚ�� B~]�SaC��6��U� m��k�6w���)���J���$+!���|�H���#��*1��Ƨ"���5���P��=?�4����q[\g�%�*��r�2�����aa��X��{�~7/Ҁy��"������ñ�`�y�>!ſc9s.4��$3��T��}_�`��3� �a(x��4���WTf���۔��:�M b��5��;BiRr@ۀ�=�9N�i�(x$6�<�+C^g�CS�>4��ՉH�Q{�����,�^6)��~.��z�@]mo�$�*���؎ ���Iz�)��P��,:��=@�����`W����.�7��l�!?<(��5��� T\b��,���c6�[1ʅ�����vI���S�r��얤�'��A��A����%*��aeB��˴�^y�f�����x���,p��u'؞����+ ���@��zr�{����������������_�.^���'~�����ꖵr�A�L"+F�� /�p���k�S����V�H�`T����WZ���6�Һ��s5��9�|x>�j;��������-��Ȁp��J,jU�ˑQ�'�wg��{�ji#h��Y�#�>�&U����a5?}V%*F$��1E�pvҰ9�M���?B$~EVI�K��lpYBcZ���vz���F���e~va[��t�Y����{��gcyt��bF(i���U�����V��8�4� E��A���6�E���gɏH�}���j2Z.W�yvv5&���Z�0TU1�1d\�^�����(�S�-"��cC슣!P+���w~F1��Da��}��kMY�Q��>t�����ɘȔ�7[������x�����SQ�L��.+�T14���#E<,ע��#^�u��BՖR�S�������(���+�b��*[��L�O��<������h��վ���n�**U��xg��B����&I]Xi��C2�$��ς)V�y�(�kF+L���< D�?��ռ��ڏ�M���'4��p�ɜt1ZC2���l]�H�C ��ޟ��T���v%�
Behavioral task
behavioral1
Sample
cec7b8ae73c56e1f63e723e4fd5db538dd43e499898f69c109b525f8b3c38a13.exe
Resource
win7-20220812-en
General
-
Target
cec7b8ae73c56e1f63e723e4fd5db538dd43e499898f69c109b525f8b3c38a13
-
Size
2.1MB
-
MD5
0841ce612dd83501de5d32a3edf5b19a
-
SHA1
e8c3fbf1de0f20adf3ada293363097596715b0e5
-
SHA256
cec7b8ae73c56e1f63e723e4fd5db538dd43e499898f69c109b525f8b3c38a13
-
SHA512
c6002bfedef742e50fe5adb859246154f7139b58aaa5a68bb0c584ac59a049e81b7244b49b53eb7c821ac790e37264e1a580730c3a81267cdb5ff8e33baa87cf
-
SSDEEP
49152:aIBcCW6URjnWyLb5PFhv+EqvcVYATiO0rg7WpmmP:5cCW6qHtFhv+jEYii1Dm+
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
cec7b8ae73c56e1f63e723e4fd5db538dd43e499898f69c109b525f8b3c38a13.exe windows x86
0dc46aafa4c02cbd88212ca9160008c1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamProperty
ws2_32
WSAAsyncSelect
kernel32
GetVersionExA
GetVersion
GetCPInfo
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
InflateRect
gdi32
DeleteDC
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
LoadTypeLi
comctl32
ImageList_Read
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 738KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ