��k���tc�Ș39������j%������Ʒ-STxI�y�>�x�Z���� k3�A�,|��^4Z�:��2"�Rm��_;�R]�W�������㩵�����'kO ;�m��!��_b�Y@R^�k�'� 8�?�@���,B�=pW#2��yA8�ֻoD4��Q�!W��y��yA��s[� �+����y-&>�E���@�`�a�!�o'*N��\뇠��z����u���H�)7�2MO��@L�"���s�ʮ���SKl�C�C�Եm���qp�Ӽ��2��?.���� �y�f��QC1��OR@;�l�A����������YV=DÄ��z�8{M�D&#e�`����W)�.�Z!Io�@�)���!hƙ(��-Z�Co������2�<=y�R�f�`p#+�����D�KTC���|*�m���r�t�z�����뒌�@/���wm�@��,0���bz�ڱ�� ����j��ĺ�^�Ոg`$�: f6�j�� ��l&|88��Vvƫ��-CO1 �j���\8��,���Z���u�L��BO�k�SS�� �x����JHDDL�`�@���h[�A����//ݠwH��m���R������F��|Fd&K��������'�m�������yAʠ������Z ����0��9/c��֑H�[lne���� ��<�5}&�a����<�9� �$1��x���ˁ"�[A��YRThI�.�gֲ�>J;�Y�����$�[��`� #�qe8p�� �za e�MJ�f`���w�%���Bd&�!��ISn(~�=����Wym�0����҉&�ؑ/ը�Gv����R0�ᐯ f���#c�j#���$��]��Z��Ъ��O���y���D���; �ht�����&k��w�S3��H; � a�zJ5����|��-���pf�]�t�\���_pR�)�1�������e�2�Wз�)��$�Rm�WG�Ӈ)'��Td��6u��)��k�*Y/�J���J6PP����c^(�;� ��L�9�Z���n��r������ލY�A��q4���������p@�5t8kG�JS�� �+u���t��b�~���˘6� p �9��(��ր��- Fw�UI����g˳DR釭<>����#�ھ'��ֈ"�;�plc�om�G�:M o�2�����>� �qzA��,���u��'k�wwꛄ���;"���� � m����?�(�Eㇸ�� A�5�,w���f�S+��,L9Ӥ32/�kM&���XjSs���.�CqCN��)��-�.}. y&�?r��9x���W��#ĩ��yM�4"��(�JP��atS?��ˌ�(�8H���ݾ�ܤ�qӳo�Z����<m��uÈqi;���������&R��g�����+�P�ڠ!��v �'O�c �wc�r��_��L�8'N1湥���������fXS�50-=�4� D8)d��W�����!���������~L/w�Q3��~�J�|�#�����Bd����W:�Byog)���p��h�;��d�2� V�?P}Ld�"���� �tc�k�Kaz�f��Ѯ{�,$���DX����E��z����[�#`3%�C�� =E��;M ��Z�',(��bt�̺T�0R��Թ ����p�v��(�+���9�rJ�\�?5�X�dS��r�s��3�X�.��^�#�&��g�e�o)��>�7�w��$0F?u�����k�T6�{;����ZwA�wF�Ǜj����E�~͂�(M~Y�OiU���냵���/�����M��U����,!��=�r��sX )�]��W�Rh2� �w�Q��R�R_8]��V� ��(|����ﴏ�:�3a��JsA�MYԆ2?-�V�M��T �jɄ���+tO���3t�$g}β� �o�$x�ZB2�!��ÜZ�f �&H�؆���3܆��>��;�q�U��E�'�V������0���d ����<ٴ�x&g,h�t�!&���u����zy[����]����ɖAa��:�7+?B�gE���C1\�`�H<��mQh�ى1�G��W{���cAM-��L���j�����p�t��]��zQ��V�#v�>��M�K�}�"Q��ر,�y!?y5_���z"@_s�Bt��䓈��½$0i�f�����\DD�%����v鹐������jw�^�ߊ K����ǁ��:z� c��R>�*��x�*���fVJkKy�*��{uCn��/��˃l�<w�m��C��AF���Z������J�*���ᱢ����������]/�1�5!�n]ػ�!����4�)��q���Z����bz�p/����u����fGwQ!Ör�B �d���lN�GR��,��i���s���[G��E�N�&�*��33%q˶�\��̹CYznM����JR^�am0Us�5�Ȑ��[�'��˕�G/B���s tt���M1!�ג�ƕ�pj�:=/x����8Ea�?�&_������(D'�+���|�<8DQ��i#�e[&�l�9[F���<��� �G��d&'"��q_P�������:�)�z������c'4�`�,�x���:?ź�-J�����1���������<��+lS@}}��� ��l��w��1���{��@��|���?CEf0y�g�4׃'K���Ȼ�X��t$�LJG�q�5�p���W�_�Z��C���OX�A��V �P��!J�Q�B�w�$���D��@�s�q�]E,�RQHH� ���x�Q����f��` ��D�M�ZB�����|���d��3��ߕђ���a�s�4L������;�\:��7���.:F�448���Dg����g�kUu�*��7��FH��6�`G�V|���%C4�֯g~��+�ʺ��vئy�A�b�A1����[*l=(K�p��6N��p���Q}1\�C�gj8K\��@�8'�V��n�q����5�^�x9#�@z�����н����Ps�z��!dR�K��tߒ���} ��V扲���?g�
Behavioral task
behavioral1
Sample
c48083e97c2fd830e361c7bda3b4ca9aa8d741506e4bca530a59329d7ad1c1f5.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c48083e97c2fd830e361c7bda3b4ca9aa8d741506e4bca530a59329d7ad1c1f5.exe
Resource
win10v2004-20220901-en
General
-
Target
c48083e97c2fd830e361c7bda3b4ca9aa8d741506e4bca530a59329d7ad1c1f5
-
Size
1.4MB
-
MD5
31a2d08e3cfe9def5a8ef790df70567a
-
SHA1
062626fea587cccaec2adfe6f60ac95791eaebd8
-
SHA256
c48083e97c2fd830e361c7bda3b4ca9aa8d741506e4bca530a59329d7ad1c1f5
-
SHA512
9af52c3b02042fea11fa9a9e00a87a1719912c9adff96b90cea0fae5c6ed4afec1d822390e49a93d831a30d3b69e6170172792b5180dd8585738dcdf9de39e1f
-
SSDEEP
24576:DtyNYs8axWGGlxVLUb3J8rExg3j68mep5BsHqvvFGAb5v9CHHzbUCX9X1t+2:88PGMi3uric68meSH2GAv8HH0Cb
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
c48083e97c2fd830e361c7bda3b4ca9aa8d741506e4bca530a59329d7ad1c1f5.exe windows x86
204cb8b50de82c80b414ef8175c38c6c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPrepareHeader
ws2_32
recvfrom
kernel32
HeapSize
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CreateWindowExA
gdi32
StartDocA
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
DragFinish
ole32
CoCreateInstance
oleaut32
UnRegisterTypeLi
comctl32
ImageList_DragLeave
oledlg
ord8
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 747KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 309KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 853KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ