`�U�J_�輸�-���lYJ�D\�&Y����t�r��JNyg��=ݾ5�p���1��~�+�~'s��a�˙U�5<�� L+l�(�6"j�^�M;O��w�TO�47�LfM;�<��I�q0�o�&u�n�i�����x��B^��n��+�7���d����چ��X�۽ kp��u�,�'�w�Z��&���X�u����.1+��M�a�Qr+I+��܌��i*ׯJ@�lY[^��2����a*ae�!�\���64������n<�x#�VKx�v�'_��@�4�߄�wn5Ry���ܯ�m���G���摗�-d�+>nd�j�T�M����n�tr!�v�'�k��w*[�3�T���0Kz�9���n�Ǒ�uS��k����ֿ�1� ?d��"�<"����^�x�*�q������]�(~���ꗿh"h�2��2!gW!X��F5�Ԃ������|�&�%������5'WoI�5z@�l1'�����y��Ho�;n��zr�'K����"�ze�o�h�b�}G3[�g@��m�Q|¶���������0��|�S��� Z�{�+�%�SK�aa,�k��c���EXt����(��*�u�A��=��H�z/�f�̼��#�,+����C�ǘ�_�V$��#x��s6%x���P��d�����`��hc��Г�ua{&�����I�}�To*U®.cLM�[��T�T>E�����%�Bp۽sj�o�";d(���k);����7m�C��'���\,�˜�9�NciߤS����;y?W9�[* �S����[/R��n74 *x1�������H��(����b}��Q����U5cFb!�7�^u@���7�gdy��fP�9�Q* j��|�؞Dz�Ff4�u�5�U��\n]Z�c&�{R���T>y6��k�`�{m_�_.������o�B��2�φvF��舚�o�W�pς͔Sz���/����)����赾W⫠]o���yH�89A�n��r����q\�4������3�j���\F`/a���=U�s|��1ק�oO�T?;_�'V�Y��h�YD o5td��8�ðO���f�tr�<���~�-�&��պ\n�b�~�a6J^ ���&Ѽ)3��{�t]dՠ�q44\��-������ق i �U˷d�2�"�ߞ.����t�l���x�v��m�~�Yǒؙ�;L��.A������a(]��e:�$c�Av�����\A�#�����>(�m�:/{����{'3�<6�_؞��o�(DU��������DY$m�����qe���/W6���Ȏ酐�(���,���*�Wb�h�ֽ�w��:{U(`[�2���qH<u�R�����,�Ǯ�i2];B���}���g��u�,�/�_lE�X�H�XV��Y��+�����X��I\���1�{_+`_0a�|���V�E_F��"@kl.��uͫ�Ԙ+KNo�����x���zi^Pm||���^g����zڻ�?|I�����|6єS������U���e+<֢��ژd\8]�-��o�DZ��-���t}l�t����Y �@����n�<S|*Y7��s,��� �����U���'�l�'7j�������QbO]�q漽�E%�l',�YB^��|�R�R|�+��G)2=`�?) As���0���5�u�z�r��O�6`�|�,�NW$�f2z�I�;�` b�}��Ay�ٶWc�����Q�Q^�5��g�M�p�S�נ%Z@G2�����0���=�G�p��-m�L����a�J�"��ڎ�JR��x�o'�nb��w��t����պ�&Rjlj��Z�l*�¿� �c���)7*~��-�h/��$'ej+�}�}�e}�=Q$���Ă��bM�Q�������E����8z{/s� ���k~�LT��l;=��]�� �q�-����o(���Ε#�Hi��S��\��g\CI��*t�h"�79�������? ƗU*���I���;��䴥i��!��W�]6� vo ,��J��I>yƥ��blL|����X�t��eX�ǽ*�a?��`Ә�ꗚ�B�1 ��l�� 1��\�bp�j�Qܲ|�����ήS7t֠D��$jP�IC#W%IYhw{�9�VD����$��ګ=���U��❛8_���5f�N��x�+A��`��g�$0�z���)*�/����|��QV��r ��k���mR��c8�%�W���L�⩳[�����x�Z"@ȯ!�]��t@݇A��ERd���a<1��������&�>���c�n���=[�&�5��<�ST���>)�f�M�Ps�+2u�c �I�i��pd��W���j8�?��R��9��z�Ro����|��Z*m0�ߴ'�sc����AF.��u���a�$B���ո`:#�I.��u��#�:[������v���.WЖI���/����X�Qp��% ܵ&�~��i�����#�c]>��7F���/J��=y'{�B����M����&P�U�8�q��;'٨���!��y�]����z3����s-2��=w�Y,m�,<Zo�RJ��.���Cᡯ:����OR�D��bcbʥPv "%+��>�/d̓����ա�_��p��U7��\G�5U!WQi�IP�/����1�zavfc�?�~��S�|6Z{jF��b���m/��w� �G�"K5��)�� ���W�q���$���X�.�$Q�6���e�=cJ���b*�8�����דH6~DLH�&��}��R]���T������"�f�$鸘���b�Y�i��ݬ�!� ���E�D�M� �m����a��1姫����I�d;~y�0�L��F�LŎ����Ǔ����OX�����]x� �Z��]t�r6m���(W�1K-�����b��֤j�e[74T"�����X}<+�(��e5�:4DLT�Woa[L���=�Oֲ�b��P/ +p�ho3i̯hWA��2�� �la��)�`z���r�/:K�o7a���}W��`ݝ8Y,��K�m�Ï��1�L��=m%[���Y6=
Behavioral task
behavioral1
Sample
3cdbcc9d28bb84050f94ed77fb08def439ba0735ebf9d054fd8e6066112bb2c5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3cdbcc9d28bb84050f94ed77fb08def439ba0735ebf9d054fd8e6066112bb2c5.exe
Resource
win10v2004-20220901-en
General
-
Target
3cdbcc9d28bb84050f94ed77fb08def439ba0735ebf9d054fd8e6066112bb2c5
-
Size
3.9MB
-
MD5
2375a85f1c95cc1a7ca5085e1aeceff2
-
SHA1
5c200961ef01b2d74c9c0562ceb440b41a9ded98
-
SHA256
3cdbcc9d28bb84050f94ed77fb08def439ba0735ebf9d054fd8e6066112bb2c5
-
SHA512
92b7825659c7360be9b9ce74ae37631759318c814b62c37267a1219bb70f2a6653e22525574a61a7ac43c5cd5d23f7c0e221eae6836952b07ee18c8ba696d46d
-
SSDEEP
98304:V9R9iWj30sVh6Cw1WeoncacUeCma0qERvEIVt6J:V9R4WwOhlzNcjaPIvESwJ
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
3cdbcc9d28bb84050f94ed77fb08def439ba0735ebf9d054fd8e6066112bb2c5.exe windows x86
c981ed230e4cb6c5b39bd5051961dbaa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MapVirtualKeyExA
gdi32
FillRgn
msimg32
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
advapi32
RegDeleteValueA
shell32
SHGetSpecialFolderLocation
comctl32
ImageList_GetIconSize
shlwapi
PathRemoveFileSpecW
ole32
OleDestroyMenuDescriptor
oleaut32
SysAllocStringLen
oledlg
ord8
urlmon
URLDownloadToFileA
gdiplus
GdipCreateBitmapFromScan0
imagehlp
MapFileAndCheckSumA
wininet
InternetCheckConnectionA
ws2_32
sendto
oleacc
AccessibleObjectFromWindow
imm32
ImmGetContext
winmm
PlaySoundA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 294KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ