6]ENJl�Y����$����D�d�4g\W��� hԨ9N�����dH�� x��Jj�X��T���eo�Lp�U�ӭ�wN���~2@y�=Qg��W�/o�K#�� ������/H��Rn�׆�>Q�;&=\3++���a��&��2m���Q�V����Ҙ�nV���۽�=��E:���4� ?)��L��"�o\0_�>+��y�Ó�����QХZ9�/���1�S��l�;��(�d��S�������Y�*��i:�q�� UBS�.���ʎW��@�0} j��)j�h$�0��f�EPKwr�۹\���1�X�X��I,t�u���N�n��%�G m�<"�y���8��ncར0A���������`gʔ/���6d��Ұg��{KK�jf��dD�H�6��Cs�v���1�d ��Y��FY��[U�������6;��/�6�a�֝XƓ��P"lt�c���x�8PԼ�A�썿Q�L+�5a�r���5�l^�ę@z J�J�|�Fל��]��C��Ý߯y�<5�.\�J���e�����/�Nma�u+WG؋V~�?*�G�M��l��<̫�����r)��?�aM���`�`#��%���������xS߂��$�����>�YW�� TI%9v]�3�,x>�aم(��%���7�p�BӉǔL�{NjJ<�/�mS:��{F�Z��7u[nIZ��� �����1��mnt�'��]<��!x��[���!��#�7�8����O/=�2n�:#+��{Q���vg�h�8���L3����Cc�o����\�#Igy���<����z����Ʀ�o{�%��{��9�TP旓yS$�ű�,��[ά��H)K�!���@�`��k? ��78����Xj�bQD�β-��S�9�m'����{�<�z�fSO��c�S��>>�mM�,���R�NX��jw]����3�,�b�3K7v�u�#n&^ Z�� �?��Nj�z�$Km���+D{M�'�w�&����j+bsƇ��S��7+5�w�����6@��,� (~W��-��܄3���,�U�K�HU!.f ��igt����֩����ju:������I�(t��T���y6)6<6I�:���7x�|g�'y{���42���$,PU��^����M;��I|]�]��<j����ZZ��������s�{Б"ʹ�^j2�2m^;�b��,�h����;��i�|�舢��e�]pH��*� ��Cf�!G����j�B�*6��Ұ�Q����0Glӎ�ߨŔ!#8���F�N�D )�$�e$���9�d?5��Nm���ϻ�R��թ`� 7���^��Y:G�K9�q6���ξEM�{�l�"��j��-ǥW��/rNȽ�J��y��*?���i�� ���I��H�ư�?����?�`,��ʉ7�;��Ͱ��� +���DȂ;̎R���?�!�w���i� #}�A7ty�lY��̫ˎ~b���5�S�{�1���T�E��a��1i�Q��e�&#ѩ����K�&��vn�P��l�������yS>_���F~<��X�E�Au*7:��ȩ�'?�Ҥ� N���Vf%i�S2VÕL��Ka0� �X�����l�.?��5:I.Q�O.�t�k�Y�.�JZE����#F����p��A�H���ԭ淞Ҷ�t�L���l�5��攲�&7F꺒�I*ci#�Ɏ�}u�Թ��!n�oZy���({�vB�R�KS"��H�Ы�H�#��k�g�@Dx-��c���3�H�rLT�w��Dt@� ��BI߹���Qk�5;��y���;YK��N��+��E8(Dž4`w�<A+N6��w�sa1!�I�aF��$$�i)�.���VEV5.�P4��* 6�u�/��+_τ�E"�K"�y�=���N���)�0�:�����$��������o����b��B.�B��PR=L��9_DKwQHA�[8�O�p����q dLV̙_� ��?�������Y���3�zF���ALH����xx�)C��`�<xX�j�F��0�z��'E$p�QS]����_�ycD���*,�,6��ga�"��Qw�ҭt��M76��s$R!_s��w'��H �;s�N���J���>q�K� ��i^� g�N ���+ʨ����j>����?]�VWm�8<��a�]Ӫo�U�m��#���������Ҩ�����#;N֡���5~�хʃ�=Y�)�%w[M`D��7XC ��i�#aRj�..F�U�:ӛ�b���8��E^ �P?~A�{��$�e�.���$�>�ה��<��SEc� ����E�D���E�X�}�����S���{y��e�P(%�A% 0�=$4^h���gt���q�,�' ��'?���M�G'���@��V�A<OX`�k�Z��ƪ\�X��h����+%Y�G���q1�P�6T��A��艢�����1��r��4�J��-QN8 J�V,��{zn�ܕ�˞dz/�����u�.R�f+g�J��8�����(`�������a��8B���|6�)J�=��*�ܳ��a������nt-X������|��G��$-�P���j��6��V�_|� }9�nឭ�'(#�k�y�[�ѥM��l��N.Ѩ�i�6OYB!�Z�HJq�m��Sxxq��؉�aK���sWwSU۾����M��v�����m���pn���X���7�{���?J�^+'ܖ�i�3����&�����*���&��� ���Vȣ#-~�O�7����}�Toj�%.���u�0��]V�qōⱰ�F���#{�+��]�^�5T���T*���c�����l�����ת��n�v;pH!ݽ���&�;��CA��<|�5E�C��M����Գq����Y�Q�~��4���a=[P_a����i��j���ķ���AZ��[�_��u��?hO�ҡ ָ��R�� ���� !b�g�`��e����ح d�ܶH����h�`Mb#�μ����\����Al�|��k�5�X}'� i�:O�O�������X{�vbHm蓹��G �����(�������
Behavioral task
behavioral1
Sample
9ff2b14df7fa5b0edc184b3b4a71353549aaaf48cadef96dca1c11fa5dcb9f7c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9ff2b14df7fa5b0edc184b3b4a71353549aaaf48cadef96dca1c11fa5dcb9f7c.exe
Resource
win10v2004-20220812-en
General
-
Target
9ff2b14df7fa5b0edc184b3b4a71353549aaaf48cadef96dca1c11fa5dcb9f7c
-
Size
2.6MB
-
MD5
2cf31602c05c9ca975fbda15190b0999
-
SHA1
bdc3b9d393d54b3b39d59539b8afdec0cbe60c52
-
SHA256
9ff2b14df7fa5b0edc184b3b4a71353549aaaf48cadef96dca1c11fa5dcb9f7c
-
SHA512
4aa2c2dfb7c89161ae020d63955e228afc41c0518aeac82e3717a1bb1a2f5a2143f1cc76586538fc0d763b9d545e1658918132141433bd473a0f880ea4840b89
-
SSDEEP
49152:QXgruTRs60NDDlIodgbE4iEo+10nQYW7WENHUe3DglgrNRVxVX1/uZp19hWag:QYz3xd2EVp+1/Ie3yWHX1uxhWa
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9ff2b14df7fa5b0edc184b3b4a71353549aaaf48cadef96dca1c11fa5dcb9f7c.exe windows x86
963c02d6579f176f3edade6c801fea8c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
rasapi32
RasGetConnectStatusA
winmm
waveOutWrite
ws2_32
send
kernel32
OpenThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextLengthA
gdi32
StretchBlt
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
comdlg32
GetOpenFileNameA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CoRevokeClassObject
oleaut32
SafeArrayGetUBound
comctl32
ImageList_Destroy
oledlg
ord8
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 931KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ