�4�k9v�s�^��8��<��\����c���J�]YH���=�_t*^������}5���Ŧ�O�Y��ձ0�_|�l���:!DY�/PA����U6ڊg��u��41� ���G���j:��J�2tJW4!��(��Z�ȧ柏7�L�uk��]�V6x�TN���m \5u��a�9ZF �#ԑ���HE(x]�8S.mP�M�`���]��ݓ�`����vE;��a���%>�`��P�eJ6�'�����������)|�k�����SiX�����������E�_�LjAb-V��ܵ�k��ƒ�v��z��K��j���=�9��l[@'@"��Y�)�+��P���1�@���!es��ݝ�|ؗv�ȼ�<�[�ZȜ%�f��N5E��Ip0>�F� ���&��?�ߴ�-Z>�[�s>�,�����ZgQ*� =��c���6(���0Z�Xó�`�5���&�Ձ�}5���)�ٱB�)����и�Y�)[_�p4���W`�Q��_nP�'�h�XA����(FZ�l�A>��B�i�mV�^kJ ����=�j6�R���@�n(�����ͺ�VF����f�0�[�Œ���@�-ht=��,���k�[���J@�G�.���.����������Ҭ��[���g^�8����d�G���_� Bp;_�Yz@��430�Ǫ�Zv�g{�$�;^Pʵ�Ž_�U��"��)�L��?N���T�jQ��ؿ���J�]��K��d��1' S~�)~!�E\&���/XSGr*���+<V�k��a��"�2����|杽C��a�.���IG�Q��G�8��d�h�NpO.[ޜ=�$�+�y���"�FϢr�j���($�h�����7l�lNL����U�E�ߓ��t,��`�:?�h@/�З��p�t���Z��C1#��(|[S���z��tQj!b�ἭZ~�a������ ��Sy��)C�ES�A�� ���!�&�"���J�-�wz��f�tz���W�i�_�u����q���)���^u���Ng�ڕ,��g�]dx@�vx���<���50c�|��;�2d�}�W�/p�r'��~�W�'� �N��lA�[��`��������S r (y�{ł��i8/��-�&�%�Z�� ���a_� 5y����!������)��ɼ��� �9����Y���G�܈��OOW�; Sy�eO���p�П�C�����ax�L��Mary/��h�>/��&4Du�.u =~��H���"�H A=����'S%T�v��k�p��ũ=PBȴuv�\ܼĉ�$E;N��#9�����,� o��(l�����&1k�k�H� �Ic~�\i��)�Z]y}%�R�*��rLP{�ur��y��:��*�!4�ɣKK*�������$~w,7"������j?R0�lv�T���>�� ��1`e�-�t�:+�,�J���=��r�h�[���^�a̭6�6��1d��K�� �L�s��<QWϔ~Ql���D�1�[��g�(n��A:�$ח��Zhb��� ȹ�_�s8��`�M@m���sT~��>�o�;�4�\ ;k�pi3ܙ�`�Yvk��QE��� ��rG|k�w�G���Ev/� GX�W��$M��ȹ�ƨr�V�!�hT�8H���kcm^ޯy��7d����")���3�ɂ,�PBId�$�˖tG��GC\�a�L2N��.Ȃ{ �W�G��5j��t+���η��*�+ݽ��x'�Qe�������e������Gh��=���q�ꖊ��4����O9��}��-V��/�i'�b��ۀ���|�9�!!�p��.-��Y�n�Xp�_���&VW����������k����8� 6���H��N�|��fL�@N�y�p��h�OJ� �rj�M�@'On���;YT��Ţ*_����)l�n@�8�,�|�:l�I�i�C�S�ş�[��)-y�(WI��դ���k����� ۺ�w�b��vCl%�A� 7����� '�X�:M Fu���Ε������ߪ������So��6\����B�3B��P���ٔ[ZF�x�!�-h:�l�ۙH�;V!��)^`Q@�_3��*���Ez �[fb�f�k�D46���;�qҸ{GЪp KMK���*���|k�!K�K�M�@�^����K��ܮ�,d2KS�_�`�5�P��O����,���`��mh�(b��Z�h��u����=mߏHa�x("2'0K�@O5�`?�D�y�^����d�b�ΕK��WU����hFb__y�0�H�)I�M��B�����^��ʹm0M&O( �0���r�.; )�_��9r������:� E@qW��#}����b���cm�*9�pQ��|!����]R��Jr��c^)T���`�f:鋎����������Ȃ�������<�c���q����^��� �a���w_V��Q���[����t��w��vݏ�╶q�;�+}*EFn����o4P���3�I�s��V����Rm��ȯ։h�0q4�>���يf�s�7�S��Y��zJ1�*+�O�6(C�6e%L�J+�H���8H$�jcl�f���x�I���\�A���ߝ_��"f�sCT9����#�aEdv�Y���A�W�.>����Ґɥ�NP?:N��O�>~�O=����<���.<���7T��iGbyĈD㱒��������%������x��8!���Ҧ���aM��o<��\钸g|�<6qieM�ٸ���h�P�w��]yhG��8 �L%�=$ ��R�f�Ǐ�n�/�P2"��eEy�i%ms���ː,@m�1�@E���^Va��﵃q��m}�{d�P��ny��Kl`����^���ֈ��š�����K���w�\�O�Q/�ujg����P]c��w`C�ܨ�>s7i��;?w{XJ�:���>s�Et����F@+���K,�XI����ѥ$���ַ9�p����EAj�����A#ֱ~:6wL��|��5=[�݊�?�����m:�<9_k$b��4yEL���b.c��wVc�ރD��͙���`�9�P�?.j3K"ZU�ێP2߁j�:��CP
Behavioral task
behavioral1
Sample
35da6d12cedc34e118ca5c89472ec4db7e0dc1222df5b6d1588c1496ce844f1e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
35da6d12cedc34e118ca5c89472ec4db7e0dc1222df5b6d1588c1496ce844f1e.exe
Resource
win10v2004-20220812-en
General
-
Target
35da6d12cedc34e118ca5c89472ec4db7e0dc1222df5b6d1588c1496ce844f1e
-
Size
520KB
-
MD5
fd79b1549320bbc0b0906c179344c248
-
SHA1
13c5bc30890f505930a290ac446f041df7eb8546
-
SHA256
35da6d12cedc34e118ca5c89472ec4db7e0dc1222df5b6d1588c1496ce844f1e
-
SHA512
a18285deef686d9b9e4dc36790e8dcedaa91dcc73dd748b456914ad442a3e68eef140d0157997cda83310d6dfe3c05cea1d85e88afe5780677ff2f457562d4c6
-
SSDEEP
12288:pAufOhKyz/qyeIZoiiKACP4VY6XG9Fz5ZTAjdrT:pAKOhKyGfioibACPwa9FNZUjd3
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
35da6d12cedc34e118ca5c89472ec4db7e0dc1222df5b6d1588c1496ce844f1e.exe windows x86
280a6c209ce2fdf5f2f405f45b4ebc1c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc80
ord4353
msvcr80
_fullpath
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetMessageA
MessageBoxA
gdi32
CreateFontA
comctl32
InitCommonControlsEx
ole32
CoCreateInstance
oleaut32
SysStringByteLen
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
winmm
timeGetTime
wininet
InternetReadFile
Exports
Exports
Sections
.text Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 383KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 492KB - Virtual size: 490KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ