�X �L��C6%��i��*6Nj��~B5��,s��Z�I�G��r�6�!�u i�O�@J��� J`�ڏ0 ����Ν��х��dSӄI)��/k~�[㿝�-��}��_��C�I8���&�c�f����J�r�A7ݞֿ�s9)�<�|��窭c�"�a�)ڔ]���xe#ǀ�]��y(~*.*n���;��/�0���c �~���Q�TIꆐx~�j@�,����h�Lv�L�������yϜ�֢�|m����HTNŽyP]勴������E���x����f�j�i8? PC»�#tdB`�fV ��0�ts�(��Y)��#�v+�&щ$��g�:|fZ��������������$1R"/<VuU�E�������ֻ�4|ʒ�n��vVv �g$k:��t�oAk�).n!e�FQ�0�/-��<�~�(���J*��;�U��Z;�?+tR:"8�]K�$�Q��6��O���_ް����B$ �By�um����r���(��j��c��ʘK������"a�")h*���J=�O�//�]t�d��;���Q�[��!��I�K�4eqҼt૦F���AJgGD��2��GQK�a�nqՒ�]�V"� ��T�ш�W�y4!LوQz�,����R���Em��a�ͅ �ON���'ڔ��5H�[�ǒ��,���Tн�+@ė��N�=' �3��W�y�A�>�l#��ދQ��}b$/_F�C��� g�~FU9qh�k���n!����g��2t� �z������+M����ǣ��i��0�Y��L�p_'���Zfj���9�Sc�Q�z�7&�-���MGlXe#��t�:/lZ����y���fN�� �!r�Э˗��uD~w� �9Y�V�/;�O�rp�}B�1V��Be=,�z��;����$;�<m��R�ݾ�i�9z�i�a��/q�ߏͥRo/���tA<-+ �8+�P����ʱγ�(Pţ�n�>����.Ȋ0/��6����j��<�tMzQ���=��p*����8D��9h�4��͎C���OU����_%``.�.����ES�:���}�.�gvu�5ǡ�Fc���&I��[ �u����-��aO�j�ı�X(-���!R�]��*R����f�v���u��,���C`���A� f�7%��>�?g9r�0 ^z�,���3SԹb��j�%<��EA~�2g��%?�2+2_��)��Aؕ4m{v�9�W/':E��aڒm�����fϑ�D��o��w��ހ�) �Զ�)@:aB�t���.��9<q�V�i�_�NmDn��3D� /�S�N���=��)�W���H�@J��-���u�,y�g�(t9�kЁ;)85Y$��s����狎_�-���CE �ß�(����I��T@��M��V��wӫ�&9Z�]�NuL�P��(0�3����sdZ�����8P���;� @݉!ɷC{��Yh����ˏe��X��� ��g2`5���JXlrgo���HTt^զ��9�E��{�P�>�iĎ��Z+@u-��OU�UyA��p�{:#�|0��H�$h��b�Ι����6��MkME>�b�Svؠ��®� ��x��, ��������Ӈ;�����,&"�������ǩ�����s} �9�mn�~���%V�J���i#���� ��f�>e^�tX��p���m��f>[�e���������]Ç(r���sO"����|?��w���&���B~Z�z�,d�����1��YC+��+ݺ����7e̳h��<b�x���9���oƻ��'�a�~���OX8�%R_+�t����e�M� ��������D*VKR����]�������/����xV�$m��6��)pv��O�b��������������QIE�>o�mC��0���(����d����~l +vJ�x�ƛ�]�5"�4�<2������ �oq��;�,���j̤'P�=�����o�����I�E��@��y:�`���q3oi�Nb{��7�V$�����ؼ�Ҫ�\�m.�+m���͘�ѭ��T��7��]��sxe���M�j��`Z��p���G6:�X�z�d�ۇ�1�]��6��Y��|8��\n�y���9>�3��1`��ֻ��u*`��e'�����y�a�J�$Mm?ò��x��4L�`H�t���}|5�(�"��2Y������/eSD=���)�5���ԍ\v�y��. �T�46m�$$�����|���9���Zs3q���!8O<��W���Ra���T���ܖ��noګ�i�� �������t���]$�/�C� ��o����7(2@�\5T����C[��Y��m�+`|�m�a̶���~5r������+����b L�=��^���?Ė��DVI���G�XY��'�+G`�9�Ϫ�ڷ~7���x��_�����,�IR,�����E��c�iM�pF�#�9�N���_��g��$;�sy����H��:>�{ߓ�P��O���<������jiV��^�D��0����\e���3ߺC�EV�KOz�-a��C�MF�Z7k�獱���[������5@6I��C7KO�dy쐧�w7ç�LJIͅ��)�,6.�J�o5�4�C˦��ё������zj�Vm|���֏��z��"�k�% �Z��MD烺j}�½ � �SK'�j0�d�Na�2��*YM��o�l�(0�y��Q��^{�N��j,���#�I����[�PB����J� ����w�TF���x vd ��%�wҐ�Rg����������K�mr�9�!5^�78�6��T5��:��/�N��7�ÆY���Y;���x�G�1:4����oM��D=����� >}����y]���u����R�zS�{O�>ǐ|۪S��/g-��E���I-v����cVe�^]��)����nnF����^nÂU���h.L��8S�Z���N�&����-���H!Vۛʸ�Gr?�N�c 3�!-��a�'��R�Ce_��v��+���`��3�=t�AF�^�{��|�BXf>YO ���c��f݄��ԙv��
Behavioral task
behavioral1
Sample
888b11ad31baceb8d7bdf401c89eccb359b833f3705fa27b92f7052970df9289.exe
Resource
win7-20220901-en
General
-
Target
888b11ad31baceb8d7bdf401c89eccb359b833f3705fa27b92f7052970df9289
-
Size
2.0MB
-
MD5
910e899e0de3410b1de30c999a1a5f60
-
SHA1
4bd416625fda846b6572873d9ff8c30757b19598
-
SHA256
888b11ad31baceb8d7bdf401c89eccb359b833f3705fa27b92f7052970df9289
-
SHA512
a067594865b9b6301e9b56bca75ca9d7116d469ab0972a503cc77308075a939294e3a61396be8363abe7580632a73da35f640211741e047caf0b60cb95cc5a3d
-
SSDEEP
49152:SZvqimCRDm96yAzDZqqTeKvG42F07WaNI:SdqimCJs6rzDoq6Q2+7
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
888b11ad31baceb8d7bdf401c89eccb359b833f3705fa27b92f7052970df9289.exe windows x86
bc882342d749fd925d61006a2b2fc176
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamStop
ws2_32
WSACleanup
rasapi32
RasGetConnectStatusA
kernel32
lstrlenA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
UpdateWindow
gdi32
OffsetViewportOrgEx
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
wininet
InternetCloseHandle
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 504KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1006KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 889KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ