����"? �r���^�B���B!��x��b JO-�F,�ʁF4�<�z�Z�2 �怔K*ߍ"�2(������H�z"�Y� %�ӯNȠ rƪ�R��ȓ��4#[a�T��i%R_�cu��\�̏h�1x�>:��S-��cI��]6\���7,)����[�2���I�g�AӋ��U����\5��{&KD ����� Ɲ+ޡS��SD�2�`Yl�r�U�zM�'��e�'(W�N/��l&m�������2�x��lm�V5j�@.s�ot���8��b�?TU֩cwL��8��RlHȓ�$+�N��r7�7���7p`�xKM� 9�iZr?ە�n���j?�y����3�?B;m8N�"�u%f(Bc�c�1h�* 8�}d���ř6��S|{���3��$�x�x�wb���zyx4�X���i��(��z&\e�¿S �������_����+Q��A��b[��� �+�ZґyoZ��^�YH�<���%�H��K �'w�V���� ��bA��n\4����G-K����H�<DͻĞd�L&yM�J5�W�E��"v̮1�.�9�S�������?)-N�@2#��8Ds���� ~zB% ͓�[v"IR�����{��(-�_�LWSC�MI��=��Nz�ag+�2��a��\|�� RDKue��?"K�!1��AҹMz��f����o�/x�֣��S����b]�N��Cś殙FUd�ٯB|9���/��jJ��n��%�T+���-��,Ѵ��o��J���yl��>�"2赡_[Z ��5�a9d��}r.�0����N��Q�}�5EG�q����y�-8eO�T�H����Xl0���:����� ����LD���Ƒ�C�]�J%�IkY�����#���������>{�ǂ9"����Ľ�|�;Ja*�<���:�����uB��H�����:]#�B�$��}E;�9)K�c��~�S�^�6TZ�� �jӜ|<sƜ�����Z���5�00"� ����������5,3\g[���N=6 n�`ӭJ>C��v�����E��Y��}���1���ee���M��J��Rz'�Lɀ��[S°��p��ɧ���X���9*0q����ܤNQd���t�j�4�ڴ2=h�l t%^� ʯ���ch"�D��n�^�1���yaE]�ފN��c�C�i�0�����)���$�/��옆�ͫ�\P��U��a,ـH�{��ܡ@����mT[�1�%%����%��U����*2g�1� ��d���CZ�;��US����ı�u����� e$&x�2�u��l��t9��X)OEn�rJv�ֳ7D�s`�t8��",.����:�A�|U7#�hh:�����$٪�ʲ��J�"�.��.���l��H�9uy�*��M�KkQ�U����:�`�7�n��9+��xf7n�0�~�'���"�������#�W"�o��>ѱ>F�R%�����Xp�Ҿ�d_ؗ�L����#���P/��Fm����R@����*��q[qX��I�����Ҽ�ұ�`��+��Vc��l�b�W!Y��g�͘��[�{��Į*:�xµ�s{��-�R��`!k7���p��-���<��Gʲ8�SX�f��&#� M��K</-��NI�헜�h����?��w���o�7uO�W�2ɆK"�@��i����BOTpgMhv$4�����T��쑹��˯ޅ����D�`��$�I]x�=�Œ�����G�#�m��C�-���_�*n��ƚ1�9&r7�L3� w�p+T�:���F��ڨN�~Kѥ "�OG��>ܬy����BM9�F��w5�l�TC9c|-$�|�x��ή�ep�h��sO��v���b#|D2��w��S8��M@Uqu7�X������j_�C��6~��ES�3k����U1��D���! B�ߥ�tp��,�T���*����j�\�{27�'�׃����oe�V-������\��� ��zx8:,3]q�����_�ջ*\$N����(d��$��s�k$h�%#�7�$+/�Xw����X�ii��}L*JwK?1�@��X�=���ʗ9ӝ����u"g�9=�9S����zm��rB�^Swt���g/��=$����n�O8N��aD�<Qy1B���5G�ha�3gIƃ�:�6м0RmRx���a��-�V�LWx��>��%��f�������시0ae�i���B����v�b��Q'�-iP��z����D�U^`�$���E����S�����\���F���ѦG�����]?�=�&&���sk�U��XY���5�eLf���l�V��1/��xk�ݘ?JG���=��FDwڽ���_�v�Dž������v���~3� F&�x���bҰr.��*j346��d���<��>�c2�c�:��ڹ=�2�E�p�v=�� m?���8c�g��H�mG���H��� �����q}ӗ<�%��c�v`Q6��7�s6��~��9�N��*ȵq����'��R���w3dC����T���Tqs�U�朽��,����t�u�=s6-|�;:��%��_�˳}�rKa�]�����3�]bh�F�:l��Ҵ̤����F���~t�� /�����T�[�Ȼ.��6���6V���2��J�|.��,YH��^���I6te�VNf��@��.^����u%e��ͺ���y+*�l{R���S�,�h�їé�����ʟ8|C:-�ه��?�}F>�~�-��M�Ҩ�����K�,#����^r�� �h�$�a����[���3��M�mbx1g5�I��R���$�c�E1δ{�˕%kb����ipe�,�����k�!!�3�:���7�����fc4�:��R=��}�:��N`钔;tٻ�~;�R��s5��_�X�^'��:�������'7='9Δ��6%�m�ǐ�X��)�u6�\���Bz��g�ժ@������9T[D���r��x�y��/�.MJ�w���7��Z�88a��>m)��s7��U@�/k�K)cM����OsCHtB v$�l{����1&
Behavioral task
behavioral1
Sample
8f3128edbb0401415f4b3ab9be2b29f7d9e0c7b6ea0a5532f0b5bc059ed1b171.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8f3128edbb0401415f4b3ab9be2b29f7d9e0c7b6ea0a5532f0b5bc059ed1b171.exe
Resource
win10v2004-20221111-en
General
-
Target
8f3128edbb0401415f4b3ab9be2b29f7d9e0c7b6ea0a5532f0b5bc059ed1b171
-
Size
664KB
-
MD5
8b1382a88ef4f7e45aa673a99eebca07
-
SHA1
5b2e161d3d60d5cf1db5d338925faf7505f3639e
-
SHA256
8f3128edbb0401415f4b3ab9be2b29f7d9e0c7b6ea0a5532f0b5bc059ed1b171
-
SHA512
93716becf57d6612f8491d2774d982dcd31c79c608dd75aae0f6728838f7b58b4f6afd51d4f94f7d1b9f8d877a4477fdd6adec2033bfb84cfff113a3489440b1
-
SSDEEP
12288:Tk86W1ELH85TvNtM3J1QahVfpDADDafmnEF0ReJFwGtsqh/P:z1ELH85Tl6rMDufmnE0MfwGth/
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
8f3128edbb0401415f4b3ab9be2b29f7d9e0c7b6ea0a5532f0b5bc059ed1b171.exe windows x86
451888b283b07d4eef5dd9cdc7da5d4f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
__vbaVarTstGt
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
ord693
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaStrVarMove
__vbaVarIdiv
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
ord516
_adj_fprem1
ord518
__vbaRecAnsiToUni
ord519
ord629
__vbaStrCat
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaVarXor
__vbaAryDestruct
__vbaVarIndexLoadRefLock
ord593
__vbaVarForInit
__vbaExitProc
ord594
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
_adj_fdivr_m16i
ord598
ord520
__vbaFPFix
__vbaBoolVarNull
__vbaRefVarAry
__vbaVargVar
__vbaVarTstLt
_CIsin
__vbaVarCmpGt
__vbaVargVarMove
ord632
ord525
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord528
__vbaGet3
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
__vbaObjVar
DllFunctionCall
__vbaVarOr
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRedim
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaStrUI1
__vbaExceptHandler
ord711
ord712
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaInStrVar
ord717
__vbaStrVarVal
__vbaGetOwner3
__vbaUbound
__vbaVarCat
ord535
ord644
ord645
_CIlog
__vbaFileOpen
__vbaR8Str
__vbaVarLateMemCallLdRf
ord648
ord570
__vbaInStr
__vbaNew2
__vbaVar2Vec
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord578
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaVarMod
__vbaVarTstGe
__vbaVarCopy
__vbaVarLateMemCallLd
__vbaFpI4
ord616
ord617
__vbaLateMemCallLd
_CIatan
__vbaI2ErrVar
__vbaStrMove
__vbaAryCopy
ord619
__vbaStrVarCopy
_allmul
__vbaLenVarB
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaI4ErrVar
__vbaFreeStr
__vbaFreeObj
ord581
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: 240KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 348KB - Virtual size: 346KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE