��(P�8O�z��f��l%����9~������r�Gu��*����Y� D��|���E&"����\%r���V�z5�z����\�����Pӗ �~��1RqV�ە���} p:c29%Y���4�j$�e-^0��G�/�L���Gw`r�*���������h'�P�IkB���ol�x�uQedY�i,�D�9��� ^@Gr�ˤ�bB��$�V����U���T��@��-ahsE�& .�3)X�I��v__cۙ8!X��u9�(��)�JG��ݖ������֮��(��"��geD|*P�x�d9JGh2�YΫO�C3WMT���m�~�.��y�NL����&�W�����W�'�<x&xw��̛�� �*����r��C�4ޠ( c��ܟK�u�V�5U���-^)�:+�؏���uqX=M�r}��Ν�uD��%����:"V����;*���S�:�v1̗�,X�:����m�>�M'Cê�����U�����*�2K+w-vV�R� B��C%��K�_�n���;���{-��)���`��q\ /��\0�7w����~T17�9gD*��\u_�{2��m�f�[��P-b�.������*!�6g�!̮m7�����b�' ����ӹ�z4#��,-��Sf�����# L1�����`�h�������B l����� uc������� F�smU�R��wZ�X�}Gb+P���ĉ��ù ֖E,,O˕���an�i*�G���121�I7����BX�ح����=�c���`���s5<`_p�խ�'Y�����#R� ~i��5݁LW����E6[��s����ҩ���t�Ef�r���S��g�������Gs��a��i� #���Z�AqݙH���.����Y��:0�B�n��)�K��L����jE�]��Ŀ���D�tr���_��2�s�K����J��"�� 41��y�qJ��������C�]��Ӷ&��I�X�����:D v�I�����k�zqN�3���.�돪��H�[NDjn�l8dv:�|�B����� 2���ē�sP���g�zF�)FѸ�Ç:��A�8Z�$���v�c�@h8 rJ�pPqvqC��7%۪E��6�(ۭ0�w������k[d+�T�l�O�rgt�3$�^%Q/�E�Sy��)�w��!m������[��n U�UX���ꄅy}G�NY�e,�j'��#��w���� o���hc��5H��I {w֮'S��2��u/� )�Ss��y�WD�#��Z�?�v'���.Κ�>��Et�Ȱ�s�)I�S~Zs��DS�Q�@}}~�(��˅�a�{�oi��}���is7�̐s?�����j��?zn�F'8��N>�J��b�%Q�4F��ɸ������V��l�2��e� ޘ���R�:f�����}KCTf���9S��kĞԦ!8������Z�U�4)T�].leȞ�KuQ~���?�@S�%O��1��ܜ��t�$��h�����i��Ѷ0��AfK����>��MD��I��*����q#ٰ싲�;�E�����M�<���/�{���_�R�\�ܞ�qaR��R\�'gÛ=aG�Z��E���@=b����1��WޡO����o�θg�ɕD���2 er���$~��'@i�~�[.��K{dU��$����6�H�ͤp�>WGK�D���v�gl!��@=V&%���C������-aIRZcé��BN�n�>�%?�h�����:�c�ړ���lG�r��"*b9��m��ʯ�������:�BV��Ϝ��?�F�o���S�����Fi��B�~ٹw;��:3��@��Vا�@h4��l��e�����yn*ԩ 0N� s��)�� ��w5�~��$U����ڝ8"�'��U)�\Z�����+��2O?%����,���{����侅}�aʪy�U���4�M:��ŮcM�r�x�$R���<h� ������l�K4.da��\Ȗ��C������m�{�Sl�=�˫���=Q?H�K?�r�G�E��_����^ (�r::����Mp���*� �̤2��}5�����+[9#��<�-����jW��2��=n6�x=������H�v��� �+���2W����9�_���/̻��T(�`�X��\3�"��L�&�qm���ɍ�P�W�*���B�����#�`�6M���J���,���g�h�4�g���G�/_ITpB���ra����k/��̮�r$�鐼5�,�p�[�r���8^�\�+�t5�y)ؼ�[���l �%;dk̘Ң5�sx��i+� ,d<6�����o���ڪ[(��V���K)'�"^8����� �*������֮�C�S���)Y��0��Ft��E�0���E�ܢF5{:T��@�� �`����J��� �J��욑v�U|�r����>��i]�~5d�2��ة.�gHA���U���u��^��~���� �]�x��\�0�O�$���'�&���VQ:&�(�b�,����Z4��[:���_�աS�К�\���'w(@���U����]��aJ���!:ז���C}�m�ʘu����Al=T[��-�S]r{��%��G��-��t������Ӣ��()��:���H'��q��6JC�}'����O|ǘ%w��-�S��C����<��F Y��Ҷ�@����^A�yI3��|It>����C�֗?"�&`� *�$�4�G0"� �@3�������0�p���B�k�w�ḵ�ո�Htw3�����o���z���)%�ͫ����lV�Q#h2gT�%���5�>���n�Vu��P�gU}H�P�šfO�x�7Q0��G&�Fo�lF��O����7_�_E��!�cƳS(������M�����$���v6�Bm�_�̙G_A�ތ���W���[�V��}���^W�����率���l�u^��X�Q�P(��\��� � N9���X�pj5t<����BK�=�>uަ3�� �I�����y��N��Ԟ$�}�T�����S0y�nm?[�Y�I���߅�ǞҌ���IO����.�-�
Behavioral task
behavioral1
Sample
ded36774b1322a0fc2ce4d7f5edefbaa0d2f97562b1b3330782f57cc0b326268.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ded36774b1322a0fc2ce4d7f5edefbaa0d2f97562b1b3330782f57cc0b326268.exe
Resource
win10v2004-20220812-en
General
-
Target
ded36774b1322a0fc2ce4d7f5edefbaa0d2f97562b1b3330782f57cc0b326268
-
Size
1.2MB
-
MD5
76a1a4a014f0eeca62c8b67899034f65
-
SHA1
186f21d0d523a0526987dd35b08e9434d6f10114
-
SHA256
ded36774b1322a0fc2ce4d7f5edefbaa0d2f97562b1b3330782f57cc0b326268
-
SHA512
b519d6f2aad2d2f988710292a62e75dd6ebbc72892f772e74f42ffe16b7f7dd5f13c439fcfcb48c47a5ee12a2311b0fceccac5ede88cf8f5f0d5e45047892ba5
-
SSDEEP
24576:1EXYani3BYbKpUzcYG7Sav8YeXe4CqS+CmEEvmpxmDEUKn:1aYaoqbKyy7Sa05o+CmEJTmDEx
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ded36774b1322a0fc2ce4d7f5edefbaa0d2f97562b1b3330782f57cc0b326268.exe windows x86
05457336a71293278620ea3c39d5ffa0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RedrawWindow
gdi32
GetViewportExtEx
winmm
waveOutOpen
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
getpeername
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 521KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 881KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ