��p����6���DYިy��Y�2�Oz?��I��5����ѹmH�j^q<u$��}(��o��.�����fb����U��8����� 4�A��G>ʝ��=��c%����Mvc���N����� ��+�%��D*����-+��.�z������7ceO�~ݫJ3���OϻϠHx���(��:���H�w�oew��e�Ⓘ@~7sg��<�<��y,[0��gn�8̪�����/s�Am��.C���r�]��%:�SP [��TĥF��G.���! �0���9�����B,e��3@ }��s<b�����ؖ�����,�o/x�? ��=ܡ�+�����R�KhE0�#�r�m����_��C�P? D�i�ԕ�����y��}�F̭;E��8�3�5;ETgx�4iUM��[#�x��X/�ME�"x`�k�� }����xp�١ �N�)3 W�~���i��7��IMyʧ�L�0[ +`x��]�.�6��=O9^z�v��r��f�-й8�m�Z)3�IY*� J�����;�2Գ�廫��d�48��n-���K=�S� �4j��P�i���E�#�#����)xxuTĦ�x2��݁��c�cԃ���>���[-!�(G�b����M��A o'�UP���H{7��{ҼfX�BA�C�L����'�G����s-r��7L_r'����?9(����o��mᣊdZ ���9$)�Z�>'���bD�\u�oUc6���z����vW|��X"�⽾�b;Ð�U��SWVXʄ� D����l����Pirqh���H�GG��J�_֮�$�tq�����By W��p�cs�%@=rp%���k�w��oMa�6gh�ZU�u{�M���i:�|֟0�%�?/��)�9�Vܮ�55,��⚚NY*/縎G���W _�������<�]p� ���裨��N��|����X0� oS)[;@��ޖ�v�L�O����^a��ڊ�#�����j����I����u���*�*�OA=,s�e/����`C:��E�����������S4��4F�j���w:�[b}��e���*j�#�^��F���ɿ�р�|���V�)�I�<��b| �ë�ed��R����ÜҤo}q3\��V�PP� �PwpA�CQ/C^?�amی�D�����3�����&���('���#h0���7������m��kEh->�p2�e/�~��>Z��6�*p�K���y2��+rF�;�ܯ�^�M��x8�p\T�F]���=#�O:RP�0_��E=�xOA'^~W^LN?jrI��燴b�� ���EzN>��� I;�{�pIc���!��,��3v6>j�u��_�l���+�ثʡ���8�+ �m�L@�v���9C��ι6����'7�EC�h �7�.���O�i�Ťr���1�7�\V(���h%���0�jP�i_�)fa�GA�g ��\��<���i�A��F�d��Ԏ���y!2��8�0=Al�^Y30j��Æx���gGv��Ⱥ��դ�B=��>ٽ H��#փ���{7آ~u��Ar��͂V�ɱ����)F�I�a�B�����d;�M9ߜ�s� �"��mL�FsM����Rx����zM�;� �O�Q�,^�O2D�ڛG���+Y؞����{z��I>RʺT}�`��r#z�#+o�r4�� �ZΞ驳�TY��숡�= 9�����-;!rhH�.J,��Z�����p�� P��ܰl��?��J��O�Z����o}�.Oe��[�oJ�Zo�3�� ��ΰQ���\��<G����D꠶����<������{Z��p��j���m�&�Jb�|�Շ}��.��\!V��X`}�ڍ�XI��+�E��8���t��M-�:8� &t��/ý�ĭAD��`'���!"*�_8X!�mA�$�He~���K�9؉x��*����Ԡ���!�;�RrKIX���s��Wd/�F�qK����/9`�z��(���t|�p�iw-�mns�������O$�$i�ư'D�M�$[����4Zy���\sh�Ia�f�:p�p�i��hR�ɢ9{�C�F������N$��b�4š�3�P�����ն�Җ��h����n~��!1���? �1Hp���(p��Xi������p%V�b�'�Δ��"F����$�ꐓd���� RŎ���g���U���'�_S��ܯFT��J�?�RX��f�\��&QB�SUǑ/�<P�ܲ�uw�[}����%X���M���=r�;,݄�4���k�����ղ�%���o��;A0? �Z����^�o�∙�&9"i�%����Wm���\q�5���� $S&8u,QN���I_��go�ԑ���W>F���nm�u�W/�%��(mN A�p˻���Q����E��{J�@Km+t�&�V�s4��t*L�� �;�DĚng6T{�Mڥ1��iP�X��boV���@ }�]�c��Z�z�݃�o���_�P����d��.�&"H��4��97��Ms �GxҼ����̸����k�]�J���rr��6�lG�ᑯr�1��8��������B�9����;�4Bo��ER�bZ�Vj[$��X�5�K�7g�ڮ?3C~���mN�I�g�h��Fڝ����}~��U@�n�ŰA!���{���� �/���_����Q��)���!ZE���[1��ߞ�d���A�v |l`�a{�؈:[d�u�9�C&7��#t��k|�"�=ej�*��bF� "�Ym�+0?"��:3����w[�:Ez��L����^���VLM*\�O���m�����1)Oy$�4�f�$�C�� �^���B���O�����ը�~0hӋp��|��I�����n� ��c��?���q�J��"��X5,2�bq>����,�-�4�N�����k�*{-�ȅ�����t��{�;�@�uӖ<��9� �}�b��t�F:������.�NAO� $Ek\�<3S�ҌO{!A�0�����=g0�f�54eXŅ���fw�I2g��� �6��� ���uH2�
Behavioral task
behavioral1
Sample
cdfe9993004b464ccaeac11f14d4581b997445a91b0dd3827b6bc042efb8acce.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cdfe9993004b464ccaeac11f14d4581b997445a91b0dd3827b6bc042efb8acce.exe
Resource
win10v2004-20220812-en
General
-
Target
cdfe9993004b464ccaeac11f14d4581b997445a91b0dd3827b6bc042efb8acce
-
Size
2.0MB
-
MD5
2a797d50afd4e1b1ebacd33170f018af
-
SHA1
ff2e7bfac8a45f51c3ae3395ec55e1a51f3770ff
-
SHA256
cdfe9993004b464ccaeac11f14d4581b997445a91b0dd3827b6bc042efb8acce
-
SHA512
5a54fdc0e41282e39d84b54a0b4b4bca981edb07ef2efd0434dbe42f0312ab73dedc55d668885c5825183f3ddf4e8a5a6fa45304f51e4e02006c5beb7e26b347
-
SSDEEP
49152:oXHsdNZ4yOD7okiyzY5ne3dEu5zpqw+WIAxE0HTQwsISKi9P1:oXMKRYkhzD5zpaO6ILSPP
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
cdfe9993004b464ccaeac11f14d4581b997445a91b0dd3827b6bc042efb8acce.exe windows x86
1f889c3d94510a932427c281139a79e2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowPlacement
gdi32
CreatePolygonRgn
winmm
midiOutPrepareHeader
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
CLSIDFromProgID
oleaut32
VariantClear
comctl32
ImageList_LoadImageA
oledlg
ord8
ws2_32
getpeername
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 493KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 313KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE