�0��)��A����٘fq����OI�G7��n_6���s,��<dF���W7�K�%��C��Y�@2�����+�n�f�E�K0�>1������e_I �+@���#Ҋeho����Yܪ2�;FJHw6��Cp�4��2Kz��r���ݏ� N���Q���y|�ʍ���&'���Lq3�ԆF�zY�Cơ�C�e��׳6�<b���k������<xk����U�XU���߲Y��OȂ����/�"O�[�V��^�a��x2K~6��k:㹬��FJ�u�>|J���V��A ��q��DO�5��_�a���,[�y���%u-]��&�~T����n�͏t�Ix$��Q�d �a8w�Z�DQ����km}"��%��{h�[����ˏX3��C��%��˿,RI]�>L��(\`�q���t&���_���U��>�S�^R�/k*�D!d�3?ؤX��Ey�v�2����+���#uP�<eF�~���h4��L:t�3�� Ӆe� �r��ƛZڡ ��۞Gp��&9��ͺ�~v�ʧE4��:���3��"��B�ؑ� <��`J:��%��.L���]I��=�`P[v����f�{>X����M��A��!\��@*�5;��T�`��\B����{Zv$)lLhI�����|Ù�U+Γ��[��"^�<õ��� �(��X�Se�(�v�]���?���c�T�|����f訾��z�� �h� ��h\�-}��:ھ����$�H�z�ȵ�d�������lo��KQT؋-[�{����5}^$�� c�&�l$�]�PLu��\��<) �� �R�u��(t�~Ф�V��!�����g�� J�u!ϖ�"��eijs^���xp����o�I/���`��ĉ�0,t�κ��QG�l �������?��a dge���A@�Ď��Ĕ���]��U;:l��D[$�--��}b��4X�I]�&m'pfZ9o�����MM��wb�6b���Vn}��V%�`���R��|Q� ����o��E��<>�A�+]����[6uEi)��&����օ�Yp��p��kEZIŰ�T�lRhH8��̈́����=`P��q�;���OE�����(k��R����T,���u���N� ��UO��J��}��~��^j��G���h���Z�,��Q�h��&����R��e�y�Y��� -e�Z����%�����Ȭ=K��뎕뾃�v���%�����%t�4���;��������7���I��=�)��m5 u#��;� �tGb����P`����t�ߛ�j��b3!��ϸ(�:�,��.�l��ܼ�+�_�ƈ��_�v71�T�3���LdZ�����6�e1�����ŗ H��Wu��{��w���9�5?��T���F�y�z�����Yt�;�?OŃ"�$�����)R��P.�KN����.6_���v��J�5��K�����.�]堉p�� �Q� �?�aC ӈ��Waep�vE�LN MnF��;�)s����c$al) P� ���!���o��|K]���i���o� �Ƭ��;�2�7Ѧ�|jٓȤf7�D� Y(Um�۱?Bbm ���4���^J��m�hT�#<����A����R6�Q%��Wz+�������(��~@G�.n�8���fX�b9���r� ��`F�q�tMF ���^���� �z��:�=�7@�&�G��is�pa�~���d���ؒn[�.�ш5WD╟:m��h6E����h� �irN4V Ҝ��ΥL��<��p��ݤ?�M9�`��'�f֬nj���SN�ͪ�=,�+�@y(�$"ERۻ%�O��R�k�WSS'h�d����|�Z���j�K��\� q"���=�c[�,yN��Qz4�vLJ��N�����\<è23)a�ٌ������!z��R3������e��cC�2��@QR����+ƛ�3)bš(�}�/Ӷ��� ��(e�2MO�ץu4R����^Ӧ� �L��� r����=Ï���F������$����#��^p�`����9W���!N@��+��3iJ"�ݣ==X��>.�v��_�ɝ�*�������m��u; YA\9q��ݓ�N���e��b.y�z�S��@!1������K���ͩY篯��<��P� ���X a�`���C&��ʹ���m9���UE ��JCtOמL�>��dU��r����2��m�|�3V4Ao͗���f7=��$l�Ie�n��-h�-ln4�Ҩ�c��+bcmׯ�VA��d��aw�ib��3]�!P!�Bh /!�_��Z��v�a��v�Amd�zR7%�1��wE��꿑����/� V��6�F3��G�._��%�t��6b��` q��Gf@=u(�U�r�`��ny~4M�ʮ}-�緘��*�~͜�;Ѣ�N��8���Z�c"N迱�Y��iA�8M���fq����[g����T>t��g�Ա�n+�'��#aO�aH�� �d{ňA����Ѹ,��Ŀ��3�1F% �A���?����px� �{���U��5~�`1�O�E����¸M�9I�"�4*yZ���5�-a��2��� �����ݷ-�8d<C����SS��""��?��u���9w��K=�k���UJ>-����$���� ��L�P6�_�X�]���g��N��Ӓ���3��ѿ���V�\^���� O���@�K�5�Ix��jO$c�s�[nk��������,.yQv ~���j�(8��\_W^�ܜjnj�Ѕ@qD�7 D¾K�`,:T�!{D�M����yB"��B��X�ҧT^��0��f�`9��~c�������߸��a}���!,pǠ2�u�cڈ<_���H�2]��f���\��W��r.;��o�M)����7�� ��^��x�����+�u��CA��|��������)Vn���Q�N����.ӇꥠN,���)_�'�s���c����j������Aղ��tV&��~7pS�3��i����\[� �Vw���،�M�c"�w��KsM��]nc
Behavioral task
behavioral1
Sample
5c22184d9b2797ee0799467a89225a8da6ad7c48b01c223f993e2b0dafcd3aad.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5c22184d9b2797ee0799467a89225a8da6ad7c48b01c223f993e2b0dafcd3aad.exe
Resource
win10v2004-20220901-en
General
-
Target
5c22184d9b2797ee0799467a89225a8da6ad7c48b01c223f993e2b0dafcd3aad
-
Size
1.0MB
-
MD5
46d54d401c04989f8d7713b7f7ca41c7
-
SHA1
3fefd21053afd3fe6b06edf3eaa0c3767e46336f
-
SHA256
5c22184d9b2797ee0799467a89225a8da6ad7c48b01c223f993e2b0dafcd3aad
-
SHA512
923412e8c0df38124c57d5381aca0a5bdf387836c510da2eab080b665cd8cfdfe1cbd83adc5aa6eea83fb1d9ae4a298c611f8177d19366c2ec3ab74abc752842
-
SSDEEP
24576:rHAbZ4eFd7unRoZPopRRQjQ2T70FY4dEXeUUdY:rHAbZ4eFd7uAPopRRmEu44NV
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
5c22184d9b2797ee0799467a89225a8da6ad7c48b01c223f993e2b0dafcd3aad.exe windows x86
6e10cea82d3c0c539d235881a79118a5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
ord693
__vbaFreeVar
__vbaLenBstr
__vbaLateIdCall
__vbaStrVarMove
__vbaVarIdiv
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
ord516
_adj_fprem1
ord518
__vbaRecAnsiToUni
ord519
ord629
__vbaVarCmpNe
__vbaStrCat
ord553
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaVarXor
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaVarForInit
ord593
__vbaExitProc
ord594
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord520
__vbaFPFix
__vbaRefVarAry
__vbaVargVar
__vbaBoolVarNull
_CIsin
__vbaVargVarMove
ord632
ord525
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord528
__vbaGet3
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
__vbaObjVar
ord562
DllFunctionCall
__vbaVarOr
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
_CIsqrt
__vbaObjIs
__vbaVarAnd
__vbaLateIdCallSt
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarMul
__vbaExceptHandler
ord711
__vbaPrintFile
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord535
ord644
ord645
_CIlog
__vbaFileOpen
ord648
ord570
__vbaInStr
__vbaR8Str
__vbaVarLateMemCallLdRf
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
__vbaVarMod
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaVarTstGe
ord616
__vbaFpI4
__vbaLateMemCallLd
ord617
_CIatan
__vbaStrMove
__vbaAryCopy
ord619
__vbaR8IntI4
__vbaStrVarCopy
ord542
ord543
_allmul
ord544
__vbaLenVarB
__vbaLateIdSt
ord545
_CItan
__vbaAryUnlock
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: 516KB - Virtual size: 515KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 448KB - Virtual size: 445KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ