�c]ȰX�3Ji���������"%{��1�*�v�� 6��̏�=܂��"�����OQ3��);w�_b��� 0�{�*z��?�R�t���0�u{���}.�YO}N���0�������;���X�g��`a�̣N&� `[uj`�������!�|�QE���&��1(�Y��ǹU�6㡃�����U��څ��#�$H�~E<��hz9n����>g�������\'�iDZN����+h����1�p�v�5s����_��1�$�_\�<�-�=��R]g�9��7��Szq��ƛ��3Q��j���V��Ŝ�'���tC�@ۮږ����=�hIm��#I�7VF���wٮ�7�K�F+�69Z�F�~�x�����.Nr��6�������%��fK9�%�^�����M�ÎW�C���6��г�UC�/3�E�Qe@�Fv/����Ag��+"��tx�k�M�v�� ]��T� 4 ����=��G�ї�g�9� YG��Rt ��z�wߛ�yبq����u�T�PΙ�����+��)�@|Tr ��!�=�~]��ٳ���A�� }4���G���R�`E���x��T�}H���\�H�|���;�N�U��� ��Y\d�N�ˍ�3��m'v;�3�C��PI9�������QhF��@�]�zSKi����I��d��S��O���$6��] ���y\���Y64<�8R�� z��!��+x��-F��5�W-tį���h3u�OP4P)�蠪|]�~��d_@k�6��fWuN��t��W���i��U�rz�n~�h��g�h��^h\�����Gm����<�ޤ���c0x >κB^r�_?���ĸ�n=���?2���ͪ'����!�=[߲EvOC�p{��Ju`v�`O�~g�6{pH��,�����T/V��&Q�A��aor2�V]�Ҹ=��짌_v���˭���iA(1jk��g4�0��t�Y��4\߄�f�Ƈ��|��@j��=��R�:]J�уr碖C`+�@/7�C��������A�%C���;k�o8�D3mI�{�c���gV��_�`�}�Y�����������a�ة�B��D�xV�u ��O2�ɚ�-�'6(3םt��@у2��*�2���6?���C5H�<��:t}1e���︅���J ����w���q<����pk��˞M��'��Ra�fV<8OY�'Ҥ�O(/ݯ���i�X��,�����ո�IW�k�@�~)&���`�b�ڝM<����J�"��Y:6ǻ�y�9ҹ��h=aO���vdl~��S��K9�}lZ���3X8{~G�/����F�^�E=�JS��Af�b<VU��30- L�A��(r����O ,�WJ��#` ���3�&�z�������������t�qC%�?Z�JzdY�`��_�5�H�^�,Ll#}�"l`�`�B�� y�ъ#�S6S�썂.�555ؽ.�b�N�0��(&�M}1�B�)=��e6}�����1��>/k�,���U��I0�V�����i����)�ѐ.&�� ˎ�l���W�=ɰ���!ݕ �����p]HS���a�i�s;�d�F����3�\�����:#�Tn��!"u9I���C��U� ��|w�5�Qx�(�Ղ��Fj�P��Ԕ���W�q;��:e{�>�e���^}���z]��1 ��F����yU�h+�����|"������?UΤn��9{ypCm�棗� ��ɞ)o�v0A+����1����W�� Y,�D�D���5���9{��Y/����QE-�OF��z� %����ч�����(��}2����������I�~6��`CC[7���y3�V����e>+��3��J� �Z%(~C���U���8���=|�啒�84m&WbGf�9��Mϊ���a@4& lFzB��2:|���Oӻ�W�xk�2t���w�C�"����Y5Nml�9$I�ɨ����Dغ��6d`�(\mC��]ˎE��D㢰"���F_b�����i-�{��o�f�VI����5&�SO���BAK�%���e/o��Pt�=��Dt��ZЦ<�P�rQ�7|PLow�|�D�PcG�*>G`lG?��m\���s�-���9}�N �� #��)j�����y��**R&��������\t5R(��x��a�6��}%E)���J/*&�ڏ�u�S��U����V� ��Ap����k��x����V�Y�8I���F.���LY3 %����9CҰ�o��=�D�g�-x� �<ήY|��a��9*�D�kD��s�͏{-Τs�����.��� ½a0�EZ��� �������Ӿ�ܧ�(�4P�Ϣ�����y�^.�\�3��^�����������]v�#��=�pz��ym{���ҏu�!��M0�{�u��H�ҷ��Q�X@c�7��D�A��}�8�@�A�;���s䤴�D|;%aD�P�*��I�9@���k�U5���=),��v�,��eH�p0�;(��F)�D*Q�2��ocnZ�a{hOH�g�K����ƱҥDu���h����_V]���)VY�|f 7��x���$| n�fjr{o����#b����By��.dUP����1�_�ݭ�����s,y��)!�xW���Χ�jX����b�l�{�u �i���K�����lg��p�5�=F�!��y��$4�䅘��ш�gtq��rD8�X?���m�<ɋ�����dUN?).�d��ӽ�6�rJȑ,1E��R�h��m��wo.�z�D��p����J>�7F�U��a%��Gk�G���=���-Q4n6 E��(@Q��Y(K$U)����D�ɠ��5��D���@'��ޚ?vl9����Ѭr�@��f��]�`��ӛ����O�%K#4�j����Rs ��#C��j�(�ז�rȱE��ZA�jMf������U.Bd�(�Ʋ��Z ���N����oWM>0Dȴ�$�ze� ��ռ콅2|sj]�B��,��,l!������O�3Z�>p�����{B��t$�~ �V�?�G��䬲�_Њ�\e
Behavioral task
behavioral1
Sample
9f29a6e942f34d9e93658303cb85b588f543515f64c8a95bb15d55279928734c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9f29a6e942f34d9e93658303cb85b588f543515f64c8a95bb15d55279928734c.exe
Resource
win10v2004-20220901-en
General
-
Target
9f29a6e942f34d9e93658303cb85b588f543515f64c8a95bb15d55279928734c
-
Size
1.7MB
-
MD5
ffd64609f760f49d5817d7b992f585e0
-
SHA1
c5399aebd38e1c2ff4396c06ec1642b9e273186b
-
SHA256
9f29a6e942f34d9e93658303cb85b588f543515f64c8a95bb15d55279928734c
-
SHA512
d1279fd9c11d7bd5da2870bbc5cea640e650d38b2efcacf00e3f055c77902b454db7d8b1dee46282538e3796de040347237c7d99adf9e9246bc8f51ced4ecc81
-
SSDEEP
49152:NZvA8bntOh+cjV2gZEiFPWqjOaRSNjO/98Cr7eSg:zmQcjDjbqamj+Rg
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9f29a6e942f34d9e93658303cb85b588f543515f64c8a95bb15d55279928734c.exe windows x86
28f66fe8128cba73ac569484f4bb70b5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
mixerGetLineInfoA
ws2_32
htons
kernel32
ReadFile
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MoveWindow
MessageBoxA
gdi32
ExtSelectClipRgn
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
shell32
SHGetSpecialFolderPathA
ole32
CreateILockBytesOnHGlobal
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_GetIcon
oledlg
ord8
wininet
InternetOpenA
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 789KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 249KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ