�s�>����<9RMV�T�~9p~��A�O ���>�>, �s���(�\���g?��He�=K��;"�úd���e�e�����2C�U�0����7{$z1����UctX�"0D��Ś�� ��������z���kM��M,z@Z�4��H�qQ�p��n��m��RZ-B��AmnOQB�P�~��A5�q����zaO����ih241P������V?�;�2���__$�0� ;Eҹ`��4N�X/U���_����h���>ٶ)\W��e4� ���"�t&,����qݾ�A�*�478��l���4��F�TBmJ��Im�v%�Ufʹ��os� ��&h�y�����"�����l���W�M���4��٭��D��C�m^�:���@�[����W�"3!�84��l�ڔf`�a�Օ��Y����h+� ��C����c+o��\�S~?V����N97D~�P�$���,��+_a������5HP�ab�%+i$/� �1���.��a�<twQ��SG��`��> IZ}�nC?/~h�3ѫ�a�A���=�"b��_���� �m��[9;�p�?�ԫv�I�o+qȋ��2�@��}&O�I�h��(a�3&�1|���}�IO�tư�}�A���4m�k.$l?5�O�ߊ�J�JWͅр����Ƅw��|#o%T9T�v��Ja��_Wf�*y��� �d�^J� ��b��Rԓ6fs��E���Շ]�}FP����qLB��P�Q2��d�| � ��S듆���:ձ-����{f&#%�zT�CDL��8x� ����!Dv��I ��P%^y<���1D���u���;y��Ԥ���h�G�[m���b�[:I�n(�s_��x�y|"�Ԣ<�\W��"�+�ˉ����<e�8�{����6��� ����9�~9��2��*1�T��g��dzF��Hz�7�+������D&i����ԕ���X�DmA������p����Є�<d��� ��5����i�����^���ie� �<��[����g۱ue����(4-a��KUTj@�"_�:�X"���&`�Ѿ2�i"4���T���'C��9X�\ꪋ|�/v=�&T���!s&;���v��gJ�䋥)�(��CP���+Z=��a�9���X�"���)���(�D�� @����e ��S/�8�Ok{�sCH��Q�l�jR��x������4=�x N�j�:`�������:�cJ�����g�3$0�ׯR�Z��gh�m���EK�y��HҸ���\P�o�����D��s ����%��'˔u���:�uj�J+� ����L#�S��G���϶��Z ����A�N=��/���5R�nQ糘8��%�oL���O�P3����@z��&����P�o��d��A�<; �� ��dĨh%s����� �1�]�:�����_{��C�r�.�'��^ +�`&��қ�����[�4����B�0գ���p�Hh�&�6��|���S���d�醐:�b~��c��c��V��X���2��J$A��{�݉ÚU�%�O�;�()�ԏ��`qܨߑ����)���Q�v�+��T����ij;�q���άr]�����DUT���`�j��4����E�[���jJ6,�1>�{s�:[���y/ٽ��-��u��89��ꔿ����� �ž@��o����}x艔�q�ې��}pX+-p2GTu-�����Z��mn�'|�̹by�ur��N�w�U�uB#y�G ?�8Қldz!D��N���]}��->H�y�Ԗ���S'&�<keQy��ڭ���&�_>1z���/��6G+���~;k��q{ ـ@�>jS;;�ê5��{5���n�y�p�ntdB�C�{�g9�} ٖTj��ɧ�F�*�<J<��bЋR9/X]M���l_��ޚI��SƨA��� n7��� �c����[LJ�3�mT�� c�:�aF� �h�\D�bD+�L�-]��[��5��n$��i��@0�8}���}^/�C�*�@z3�BܑV*����#[Z��_������1Dv��$���\-y4����ԅ:�K�w��G�ᢱY�f�J Ј��S���Xk�n�qF�Q:��4�iu�%<��Į:Q���B�k���;��1�T.�˗���3��C����b��]tp< ��r��p��)�R������K{�r�a;�å�������mYT�3���Z̦41�a�X�UWY��U���0� u���AV���kih�Xܛ!�l�T�a��,�2 Щc�&] �|�,�3��������M!u�1�<�N@J��j7��G�1E���2楜O�϶-л�aj����a$��E��d)�q�4Y �Ϟ�C^n���5��t���W�����o�Y�h��� �i�f~�*L"�2e3���N�������!�p�B��'y���6U���D��uC�=�v/�a� ���y�*x�E�#�-��6��`^=�狰Q�Οͪ� �k-�����_�ڕG�A�K����*b��k�y2�����i���G�-��dSW j�r{$t��]�)�,�d�~����!{#i+e�;8� ��S<Y�^<2E$�l#������H�S!T������7���@�4~��If��7�ʍ@��N�k�܃\�O.���~Ƃ='��=��W�1C�Ζu�L������$_id?�kƎ�G�D�O+� ��<�3�M�~'�[��B4�W��mN�e�sQg�x`�����;������^�딴=SB�݇]��&2j���xJ�?��}�8h�km��8!���cr����CO�<})������^�ٗ��S�gq\�A����B���D�I���#�`nM���� �[GY�+����Q�J�һ��M��W�ɜ�y+S����G�Z�k�q�ˮ��!3�v�Fp��+�na�� ��+��5�� ]v 8N���&{��>L�/�AcR����?HU���o���/�i<�����zw����Y �̀,k��"��75~~8�+0��3�LJ���&�Kl:�L_j�oB���RgC4�f���<d��%
Behavioral task
behavioral1
Sample
74ac7bef00d83908c8498e483868796716a06e258fc4b7dc68c7608d15aa9b19.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
74ac7bef00d83908c8498e483868796716a06e258fc4b7dc68c7608d15aa9b19.exe
Resource
win10v2004-20220901-en
General
-
Target
74ac7bef00d83908c8498e483868796716a06e258fc4b7dc68c7608d15aa9b19
-
Size
3.5MB
-
MD5
0245498baec60bf7608f7511d10a70a9
-
SHA1
e3fa5aed6926e35c4971f50f3cbd979d0d03f738
-
SHA256
74ac7bef00d83908c8498e483868796716a06e258fc4b7dc68c7608d15aa9b19
-
SHA512
6b43dda07a484992dbcbd4e681e0b3cb61dd49286782e204ac38d0fad6cad57e9d459b43f4611ff8504950ce6e21fc8dba45a3a055d1ad553063837df67506fd
-
SSDEEP
98304:91tesDC3dFo+xiC7E+xMe5wTUmH6c7M13uV5w9krfKD:HTCDy+KznHbS+V58kL
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
74ac7bef00d83908c8498e483868796716a06e258fc4b7dc68c7608d15aa9b19.exe windows x86
0b1e578ffff356a029d77c215c1b576c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileSize
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
gdi32
GetStockObject
advapi32
CryptReleaseContext
shell32
ShellExecuteA
wininet
InternetConnectA
ws2_32
gethostbyname
urlmon
URLDownloadToFileA
shlwapi
PathFindFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ