4��;����������-]��TF�0�j\�mVx�ɿ�����K�~���������R�ٖ+?'+���m��-e�>�q�UR��&��?� x�b��W���3��)��a��%E��CW��VB�Y�H��;�4��%ԑL�I�z�sH�����#4%~k��������>�K'a��@�To-H�:�&s����� _�!.��3��#~g���EB��rprC��d����X ?iq ��L��8��IF/�����������н[��b֧V��l0V��)uֿ�m��0pqǒ�Kݥ���߳�x����� Y'�|�ABS4&�Ǒ}��dž�*f���}p������B�^�F�7�l%L鼐"�oz�W�j74����E�Q�t�"�2�$����T�%���z��H�q��CH\�-��z8H�,��mUU��ndm1�9�d����D���#:�_�|���j7g ��yv��4Ѷ�m�����h�����!H�}G�������R�n��fM�ijfe�E5��G�p�C���,�*�@MÖ K�84UQ��b�5����9ä=��D=J]5(�5\fY������<�>LU�f�m���@�[M\�� �2[nc��Pm�A��y3 ���&���|�ҳ�j�w$��_��x1�]ŷ3%Ip��ȡ��_� ��6�K�4�H�zv# 鴄����k�$����t�W������N����Q���n�vgq^��.��� &Zg*�`㒼��r���������ko�9G�C���'��@����;;���㧒Ӣ�@�=ɥ�߅��McO���'hI���-�,r`;��2�]����Ё�4���tD�#b������u�o��sVu7v�m�.�<VJ����"�b���,25��%j�����ފ��cF�F��yUTo���������gჰ��¤��r~v_�4t٠��m�L�UR gH�JN�������9n^����1#zKQ��nUy�Wф[{Px��qzh��i�U�J���g�S�#Х��Fx�y��T�{Ogq�j@��ʀ��-��'����E�<��Rvoh"��%D��ZI��Fj�M�P6h��2[ev4l���Q#�]k��h�zJN?6.k���,�f�PG���'�拏����o��v�;M5����A�d�ܓԹ� �{uf<����C4�x�S�Md�& X�K�bqA0,l��E��Pu����oTW��@��u�v�/d43��QR�J���)��/��mt6��P����ƾ�47�A�9M�X�=� �'J���i�}#�%���QJ��4�Uǜ��(�y ��dlk��S�yq ���XL������g|J`�C���j'\���u�C��x4�ś�E�y��T��}F �b/_O 4rD����BW��h���ee�5.�a��뮼��'!3q��A%���֡�)�i���۠>�T�e$O����^a��C~��.��H�x�[�O�2ˁ^R�[� ��R�ʅx����SL�od���4�w��_�r�����%���$�O<F�h${e�S�� �)tɞƜ�ź��/������^� ��BV4��B��Q�,�#�i�b�_�֦c�����;�9���M�?u��C�^ xQ�$DN:�4W6��e �*Nhj�ڤ�`�0}A�����6P�A�4�pu��'U�Yl&�S_@Q5rqQ�\[��)f�C�ػ� ���#��\���bԃ»CO �k6���ȉ��b�M�����N�Q$�Hj�%�$���D���-uW���l�� V��z�S*��<q�������r��^�"�W�,۳�Ңw��ȹwUxtq�F|��X�O�A-�Xǚ|N �����.E_m%ê�&8=��d�tȽz}c�����S��t�ߐК��г��wυ�@D��������VB���#S�����������#���L�]��<�4�ؠ�R�>x�P�ovouy9F�qYp"BÞ���Mar�^Vʨ~l�&C��v���H+�CoS�#b�Tz5~� �_s�K�7�U�/N<��>�U?�qX:���9Z��5 5��;b/�&8M/�i������-�F���]��1A.����Z�.e��I�h)���S��C8�iA�at��,����}4ۻ :�&�I�(��6)# #h[��۟���J�<�y�gX���ef�<����\���f�eȁ��y4?Q�6�f���=hI�+EuXtO迟�0D!�s����M��$4%T���(g����_7�eo_H:�b.����.m1,,�`G��)�(d������!�z_����'�����|D�c��U�}lJ;N,j�C;�r��Y)䏧��-��R�f>��f� [E���s�:<:q �K*�O��8��ؙ�4��#�U��E_M�R�;��)V i䚳�)�ǔ�=dE���P���/�ޜ�Y�s�eH��8��|���x�8�T����1)�����, +��9u� �.k����M.T�|QA廰i���b67�Wu���ӁB;dA�b<���pj�B�B|l���4vVfl.H +~���b�t��3T^���v��nM(m����5�ߔ������X���LY'V��S)KP��9�� "���B�$���ԧ=d�xu��� �;�"B��i����o�㳙�\#W?�����#ئ�9D���Y5�R��2gP�����^s>�_yb��(�ŝ���m��ɧ�3<�4�54R��F0��r��|8��2h���i��*�j����&)(�L�f�@���l�&�=Q����|ˆĽ{��#�������0�(��?��+��X��]T�ar�4`��5���8�!��D��y��NR�曷��,��炮�ٟ�M���X-�ÿ�Ȱl�uD�vlH}8W�)��#�q�j�=�6����iC��ώA���E sݝ\��H~8b,�#/�v��;sU"�}�ln'���{�t-A_ͱ2����C��6i�"{�E�]A�5�d�!�zfc�п^��"��IQ� ����Ӧ����!����(��[�����Y ��Ew5��ڡ�/aR��X}KSsM�RIep@�%K�'�8�$��П�@
Behavioral task
behavioral1
Sample
2ec17a84fda5099093fdc86a3a8ff231431a3919d225e2858c4b68b321271ba3.exe
Resource
win7-20220901-en
General
-
Target
2ec17a84fda5099093fdc86a3a8ff231431a3919d225e2858c4b68b321271ba3
-
Size
1.2MB
-
MD5
cfb1293b1929f362c707a956b5b414ca
-
SHA1
f0e39e3d7eca81730c89b6a8aabd238d6d101670
-
SHA256
2ec17a84fda5099093fdc86a3a8ff231431a3919d225e2858c4b68b321271ba3
-
SHA512
b570b7e1cb5830c8392c95f8120711428bc170365956f4eea5ad1831234663d7283ab063deeb6df8fed393dc23e2a7e123b6afd19934d618978b4b36ffc72747
-
SSDEEP
24576:y2BJ2HpumRb4UpnzyyMFmB/z0/yb8oyDv9FuRWj94RqIHHvFX:y2BoJtRbXpzUkzOybizK8IHPV
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
2ec17a84fda5099093fdc86a3a8ff231431a3919d225e2858c4b68b321271ba3.exe windows x86
ea815afe3ad98dc846420bda9c13825b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPause
ws2_32
WSACleanup
kernel32
DuplicateHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowContextHelpId
gdi32
SelectObject
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyA
shell32
DragQueryFileA
ole32
CreateILockBytesOnHGlobal
oleaut32
SafeArrayGetDim
comctl32
ImageList_GetImageInfo
oledlg
ord8
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 716KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 551KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 301KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 416B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ