�O<��W:��ޡ���;����%ژ��Ty�>"E3.�Sㅻ��7���ߋ�_�����ȿhΑ,����o�_P5��[�˅f�Y�OGImI���ݟ�H.�����d�����@*=1ᄉ���[?T�4"���,�A�\��{˖�%���A�����նk� ��6f�l 9��LJ���5i߶���i�I�k�"��/��8�0�&����YB)Ui�36��;F휩��;����*��� 4���!�0���Z �[���h��\?_<>�6��DєnuA��p��s)���w=�=~��~{4�t��-��u���\ ȷ�p5��"�&^���#g�(H�k�|���Y|��������0�U�/UWe8ȗP�,��T�� �.�DڧS��jT8�/R"}?�&ˀ�2WTP��χ[�Ƃ]���%8�)3젪{��4\(AC����~:�<㉭X�ުSj�vJ�݀��K�U��; �϶8��}����߫�ܦ2�G�i��I�%����6�3��Z���<�@4U`��Z����k(@��*����K�|ܺ��eJ�����KT&�Η���Q/�)L-K��H�l]YO6��%�pͳ�x�B �a�\�n�u�D���Q~�XW�2�� �w<��"��l�\8JBTB� ���ą�ً�GX�PF�R�]�8Է�m(�"��K$e�"o�QKK�~7�G� I~��Y=��@I����&.;%2�s�_A�x���������1,���8 9�B��=4����:q��qKݻ���^'m�'0��6u�B�B�U���:���=����,rf>�2��$�Z{������4�"�� ����k@���2�F-S��ս!M�;"��a�3����$u%@�pI��W���X�������� 41���J�����%X�P��M����)&k�;��r=�gH\��.�1,T�i�`��J%���5S�����ǖ��)}~�)�5� �謠��SzYN�yl���#.CO��mrbT@?�a�8�����jtH18��b��q��J��"'�z�ҥ-N]�Sd�c�Ne?_��;��c<��ᒠ�@��`q���>�.�\�*v�p�T��]����҇�����-�=AP�K��̰*gh�}Ofi�H�:5Ǿ�6��fLt�]�|�a�S�g�td>E+�(�-�sht�`i *N�]V�T������8�NS�Y��j�r��c0P���o������y�`�7��K�F����Nx�*70�}��1r �3��j'���[����U�V�iַ=�d���(�� ;f^��^C����bk�tA����8YH�aԜB��m�g�W�j{j��F�<�R��DV��nN�\ih#J�Zڞ���U~���w� 'F0i��+�z4xs��H���fg��������-<��Sљ��<N��G�~g��B1����f���һ����Á�ى��j�=<���bqQ���O���?�� �W�l =a�ne>���vx��]�^{���� hnX�W����1 �|Qب�٨Д����Eu�����6f��N5#m�����=�Ӧ'�{�Y-���i��Z�t��>��?�p�7��t�S��=\P�rE��x�dhZ�5�w����E��u�8��l�no�1ԯ[F�ƍ"j`]�q�?̙�[�����=�W�(�]m8J�`iB9�s3 �j��l?�UάJˬ�?��NrO!�.�(����C��^p��D��>����Z����128a�- �Η'ue"H&%�[�����D��5�jܽ�]�!@��1���u;�R�\4�)�OqAA�����f����?*ʕ��ˌ�SQ��µ��غI'����Ka3G?}l�l��s�:�А'�)������:6��Y5�β+UM��� *��ʜ��u >��O���# ��eP5fs�\�RF���7�����'�s��hJ`��xV�o������5nn�4�UP�5⌼B� �>��9�+.����� ��g�x���֜{.����g���-'C�ޭ'T�~����1���D�� �Q��iD�Ҕ��M�j��%�E��j���į���L�H���U����̝������$��)�Gl��ṃ���C�f+� w�3ix�zgRJ-�6�hg��F6��@%�s�����]��+���ћ@ICG��5o�h���������W��,i�\�����3]��Cj5��I&�3�Pn���9��6�'�t�U�*�#�2S���К�z�T�X���������1�Z��Q�c��R�����$j�sD�'���8��'�� }Xn;a'�����;��-����4��O�`�i �*.sZ[j��lh��VU����JQ�6�cj �6���*�1_Ý�(rd������kb�N���}�[���-��~�ϙn�wp���`@%�ꍦW_g������e5 VUl�n��}+��%����l�7�|l��H$���9E�����D�L�����f���ה�_�9]��v�( &S��{]�w#��c�J��N]KE�utΔ��-ֿ�0�4��l�-�����Q/my���SS?��O��Y�I;�+��;�3�B�[����V��m��nw3���,H��b3��4D��T\BP�P�rѧ��S���Kz���j9�<&��/������'��݇Å����᚛�i߇:~O q!���t��ʌ���R[w� �Xۚ�ٰ�K��y8m���7�u���e�;��wy ߚc�#^z���I�S����j�,z:-3���ĸʘ܊]h=����劆 &�� �������V�,�6���V:]���*�P����Y��s-���h�@�"�ȡ��#�S�LL�4�,�T��R1����A�Ѥn���mw|<Ģ@u�����%-����*3�љ�5q�2@O��|S5��(�/W�"���x ��Ј� �����1$oY��d��;��-�/\h�D3�����Em[�k�w �Q��tؙ.g=m�r!SVA�D݅G�ž��VUz��>{�i(�kl/
Behavioral task
behavioral1
Sample
ad74b61cdfb824103440b2fd49386a65eaa7ca8c31e7ac2daba0d60563dd40f2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ad74b61cdfb824103440b2fd49386a65eaa7ca8c31e7ac2daba0d60563dd40f2.exe
Resource
win10v2004-20220812-en
General
-
Target
ad74b61cdfb824103440b2fd49386a65eaa7ca8c31e7ac2daba0d60563dd40f2
-
Size
720KB
-
MD5
1c73c9ea9947764fc8e2666ed79a319f
-
SHA1
15594f2aad38f9549f05d09e2448be108701029b
-
SHA256
ad74b61cdfb824103440b2fd49386a65eaa7ca8c31e7ac2daba0d60563dd40f2
-
SHA512
141441e3b8f3afe62911e4fad6dae8e47a17a4671b2ce78f51dd16972cb30656c081cf9043ea1d639a735582c184fe88f431bdf727fa81e44a97019a2b650597
-
SSDEEP
12288:TIEWcbW2pBBtgcN2Ydn7ZidauuqzbjKQ4QlRRdVqZl5kYVbKbgxKsL4b:c1cLpBscF79XqzbySRR3clsUEsLY
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ad74b61cdfb824103440b2fd49386a65eaa7ca8c31e7ac2daba0d60563dd40f2.exe windows x86
3b96cc438968a5c623398b292c4bf097
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord616
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 708KB - Virtual size: 707KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE