�G'�Sj�m�U0CV��AnE�$c$*Di8��L����}��B��%˘\�����V.2�h������c��P���[�T�R�Y�M�~σFr��ڎ8���gOQ���4�V��]�v�/@���֝�Xިh"�H�y��3G�1��g��K�J� ���,���3�q�#�P����9ʴ���kpDLQ� �{��Q��cf >W���w���"���\�dV�G����s���k;(]a�Аf��S[R�����dN=�����5d���a�2�7tGo�-:��v /#��������g��zw5��*`��-M!�-È�s ��v�)���˂�kd�ڿ���ƭ�߇c;���T%U��W��� �����4��s ��%WҘ�巳ǽ��=̇.���|����M����ؖ������x,�\������V�S3������#��XF��*�kY��ؓ�x������9��v*�*�V{����Cߧ�7���A0�<�_^��� �GЁ�P�?g"�����N56�'���0����++8��M�U����� .��_���G������/֭�W��m�3"��؊P����1�ʍd}������oݚ�~d����fk��������ڃ�z�r�mA��SCA��t0��ē���J�$P�R��ZBa��;���5�����W��5��y&�q� r`X\��d��+�W�h|~��{�}ci � �Cђ\cZ##�ܤ��:����6�҅�o0a�J~�d��o`/?��t���w��N\�I �=��^Z�`0��Hu�;�A|(�Mx5�/_;�n�k�/�A�'H)9nE�Ŋ=���6�89a�T�'����(�1���߃���Ah��!׳�G6�&�I����9��gA7P1OIJP`��؆Kt #4[�l+�"(9HMˆ�R |o�⦛��~"�����&�����Lv�u�͉3֛u��= !����̓OS��gZ���i�ş��3��r��0�OR�J��;I�A�j�v��[b�]�K ,҇V��Y��[��]��|wyk!cڼ�@��5�����m'��W����_'���p�5&�� ���sn�9?W0'Z���#��~���I�?wpɍ�B5����"�b9V��3�%�\�(ÌoK�I�1#1�ߧW���/� uY�n�2���'�q�G%��K�u��Ƽ��}����K��& �mV�D�� ��#�§D&S�賒RtSRbI9 ��������j���<F8||������?��<4�����^;�����LzLdOb�v`n�xSo���Y��VW9l�d�ޙ9o��8�K���6�W�R}���B�X���2_����zsj���+�w��t�)�u�|�-.�Z�z��+p��ig�~��� ���5�k=�Q8}���&S! ��2���Zw��&��Ѣ�ZH�-zkϨ�(��I&���W$n8�����O`"I%�Gh��.sH|��R4�{b�|li(~��@����߳#����v�� ��oԕ���6�� ^a��K��k �}{��3�~<�H#�X���g5�+n�z� ϳn���ti3\YC���Uu��E�q%@"uz�'���_�<,2a���]����j��v=8s��6�=2F�e�N�����0| _�*ǚb ����cwӕ>N���/<L�l;ζQ�:{J4r!r��N���L# ����mPb�m<�����N�!�����쇰�� ��:�B�!�Ґ��_`�:.�\& ���Ǫ�����_�@�p��?uo@:�)'���!BKS���B`�FM~�R��5b�8=���*�X�1�� ��@I�F��x?�Tr"��g����=tm�w\���?#~͊D�3��"���l��:�o�-[�ޟ��Ө L��2�Y#YO�j\%&7�ڄ&���2�{�q̬��$�Z]d*@��O1�f<��-�=�᮴���t ���j� p��T�5�H�o� �J�Ŝ#ƾ&4�s앷���.�G�?Ӕ;v��]g�bs��b�+#�5�mh�d�*��w� �ʖ��O�i��ir�(�~��`��t�3!yx6B��!S��SbH�74QA��~��p!`�M�2�F*�z��c���͛�L��F�q�s2��a����z��ݑ�e����}0�l$������m���+'����V���U/�32��������!|��M��Y�ѵ�ٔ]yf��`X�����=Bj$������7lʛm��=�w� �h4���&� '�A ���;(�'@���\9**���=�+�B��T�b��O��X8��Ѕ>� Tw+X��Hޗ�`0�d0,���~�������VdHi�tE���o�`qӂ$���y��|M��@�˃�JH:yG�G��6�u;�G���/�N;36)A�H����;Ba����B�������ڞ�#l�k�46cUm�4v~�xtK�6�`���_/S�!TG��vKӷd�^�9�sf���+ظhp����3����Tm�\���T}5oʃ�A�y�Z�Ax �>=��=T��I�G��xI��6�qU@���tq9롴Vdr�m_���T'3�jHG�m[z���/��$6��#��=s�] �cf�wh�60�;J�R,�zԸ�|����~���xzh��U��CDV���I=�nߘ�#л�'a;?xt��m�A�i��*{��8X�h�G����g"�,�����2KD"�^��[~DxÀ�O�LO��&/9/M�9�r�r�>>����#d�R����ؔ�XX�e^`̒GOJ�1d��lty�&�(�a ���b�-����cDzb5���;8$8Y����i��S]��{^4���1�Z��6|a>��,g��*�vz3Ouy��yv*�NW�ډ�����~/�v����0�Y0�\�:��N�r`����[^�\�����o��a� ^��u�;Q�͔,G~���~%'����8e�c߿�j@�i^4 ���k�Z�7�&}z~wV���)_��?��Jp��R� ��n�OQ��-��<c� U�_a��r�@g��g�:�߁Q������y�qChG�ˁA�x� ���T�욏n^��)��$���۴2�GGI�d�p�eW���徛7�h(�� q�
Behavioral task
behavioral1
Sample
64b66ec9cccb2ec8c084fd80fe4446fd1eef6582660dc5b9c41b04c164281b9b.exe
Resource
win7-20220812-en
General
-
Target
64b66ec9cccb2ec8c084fd80fe4446fd1eef6582660dc5b9c41b04c164281b9b
-
Size
1.5MB
-
MD5
cd039c81e0b077f01f45e8c5bc0ae724
-
SHA1
4de08e068cea1cf59b8d47f73aa7d8914e450542
-
SHA256
64b66ec9cccb2ec8c084fd80fe4446fd1eef6582660dc5b9c41b04c164281b9b
-
SHA512
474da1796671a68d7ee92bd1fc0509e7efe38d17e65017e7b132fe9d5bc13d95623e7f0238ea270be025e98461b9209227bc4b2fe151a2c936449cb1f49cea01
-
SSDEEP
24576:brsWZ6Xvh2kzfq3o61/z4UFcReDy0aU8b2svrohIVXPx5UPza49xkqSOnFEbw9C:XLW233o61OeD16bDZvUPzaAxqOS09C
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
64b66ec9cccb2ec8c084fd80fe4446fd1eef6582660dc5b9c41b04c164281b9b.exe windows x86
597ad4e5bb8ccd31488820ca1de70842
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutGetNumDevs
ws2_32
recv
kernel32
GetStartupInfoA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ReleaseDC
gdi32
OffsetViewportOrgEx
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ord17
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 435KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 879KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 218KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 336KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE