'A5ˮ�� �Q'�I�g � E�� �� ���Co7���KosR�CX��1Sm�A��y=�������"�0���3� �x��c�aU �81��~����)N~��-��S�M�7��ŏ����|B�LF��+�7�Sp�.s��s ����9\����Y��{�QF&չ�+sUI�O���C�?%?s�bc,�~�T��d}6�:�P( )s[�� �Q�WK���M�IL��n �c��Eq��i�?lm �d@��tt���5�oL�ҵ�!���`INi�&�vp��d |�����1g[����}+w@�nP�(��p�"Q$�{ʎ�ܦ�! ����8ǹ�� E�0�O�# �8����/�T8�aK�7�v�8(���"dO�:����|jdv[*��!߄���d��]��;'r'���K�T���S��Z`��r�Tߠ�G!��� ���#tC��Z3��-�?����ݪ�A2��3#t���p$�]&�;��Q��e8�D�j��A%b�%q�/EŨW`�"�xцH���x<���w�v�b��"�&����S;�k�|��T6����?\7I1�d#�"�^&�������L�F�aކ/�r���xS����%�_#ai��j�<��$z�������υ�hM���bg�H���=A�W�>�X}lUA|���[�����S��؝�Ƚc�dq��q2� �D&��t٥[XY��@Hҿ?9` 3������ޤ����%^���:W��C�9/Ǩ���}�Z����L=T�u[?�h��>�%� �y# x��0��D��I-2����G�� �ݢ5��EP᱈�=�w���LP3�� ��o�P}?_���.�չ&�(��������8�{��K6J7�%˓�z�/2��'�џ����)Z`u9�O��'r.J�c4�%¡U�J�[�k�s�Pz� �4���ww>������� �% �E�[a-;��d)�2�'r�64�J�T�S�\9�����O���-[�715��\W�}�97���(M���N��Y_�Z :XH�W�}����r�{l�̤"��S ���}c��Pqm��?6����b_�K�H�U� ��0vn������c���0:H"xQ�t�'���9#=��h��yIR-��K������E���g��bw6E�����:�ۻ���hX)(�[Z,"�~.9NT��lnt�s;ޚ����� n~���7��f�1gA��1o�Y+SSq�!*U�&6�Y!��F���H��I�,����� (��x��yu@N���Z���@��Y�5���^� �_����y��yO�7�=���"��LY��ś�`���s�L�a�����C�.�����&M����h����"ň:�>H~�ٚ�c��ݥ����ClJ���3}y����x����*�7WX|/�B��@G|���W �N��� U�{G?��x�58U��vEΗ>.H�p�����"vtF�}w8�bϊ8�'����h-���p��2�M�Q����-U �ZE�3��(dѝ��c�Β�����q X/~�a��%�Q��e��ы��a��#v�:�U��W<��B�����T.�!�\h%�LU?�#C�Y��$[�R[�^2��9e��H����\đ\����"���x���0�e%k����H5-�m��70���_#�A�B��*����}�W�O���c ј�Fڽ^j,Du���H��<ߧUa�m��-�Cw��l5x��,� H�'�W���e���LK�'qE����+L��4���AQZ����v���B�)���9�{mf�#B0���U�d�/�q�>���VU_�|e�-i��ɟ���XD��Ρ!<x�� ���(?�~ɌH�����[�ہ!Ǿ�.�'R������x�ޗ��?B�� ����;C��7��.Z�Vȶ�����SJ��¼�9o߱�v�3K��[sy��u�C�}��PX$��~��1��� ���k�|x�e��O�R������~ �Kݢ�m�ZX2�;6��`a˟Go����41B,���8���r��iEN7��gc�Td.���ۺYYc�Π���W�/Y����%�����sd{u��� {�m2װ���G�z�K#�� �� �dzΪ���'�9�z�8}]Eo��Q,^��5�F���{��F� v|���R ��9�����Β�����͝+#o��{]xK]��GZ� m*E8�wOڼ�]T� AN �=����g��������>��K���u#�".����t�dv b�����J��|�9J]ӹ�=�&��Ч�kN�0�L���.���-q��~���� �~Q��Ŝ�^�Ǯ�1k^��ʷk�>!!��Pݥ��������z7a�� _p�ޥ����HQN����S �t�d� -��@HF'�W�W���`��!�+�,���C�lu=eP���qRo!E퐂Xjy�K55�����S�(;z0=��*\�a���M���rgw`}�v5>[��h� �iƜl��aQ� dmg��sHKA�(-٫�i���p����uq����HH�UEb��:�osff㝏��r��qxj�N�k��$�j2�X�;f[@;�xլ����Z�Q�p�:�>����wp���U�M��n(�F��+����w;rd4�&�]�a���6ܵx��f �o���͓�F�23�#�f���q�!��)5�-�A����E�� �Z��*J���*F�7i7Ԣ�����{��#�͎L�S�/��]sC pztukYe �e)��~��u����2���%A ��gR�p`��� [��4��z�x����%�XR��Q�VͶ�� n�]?���L��H�=�,Y5o�~��.W5�A��ƽ�z�%�t����KNچ�4�-�������2����U�T�]���?�J�SrS���Lb�� p�s�!M'J����(DB�i�˷!'�~� 4�K�O�0&p�ed���-q���f�^���~uգD6��df�����+r^M�����®�؈;��������k��u�8�\C�(�1���.� �R�
Behavioral task
behavioral1
Sample
37c1706b433423283953ac223dc00bc5f0e2c3153d3553379ef9d219df9cb0b0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
37c1706b433423283953ac223dc00bc5f0e2c3153d3553379ef9d219df9cb0b0.exe
Resource
win10v2004-20221111-en
General
-
Target
37c1706b433423283953ac223dc00bc5f0e2c3153d3553379ef9d219df9cb0b0
-
Size
952KB
-
MD5
6528e49d4f7100e6c542046ca6137b2f
-
SHA1
24f386d8cd4ef85ab8c35b58730ddf5a2fb02730
-
SHA256
37c1706b433423283953ac223dc00bc5f0e2c3153d3553379ef9d219df9cb0b0
-
SHA512
7746caab6c08754836811d55d31eeb8e7a80c3489f32737b1b5a4e23a723794b23bc8bd2f91da8f0702c7c3fea68d8a3b1239646835f9aa8c52d40aab1fc59b4
-
SSDEEP
24576:jzkFgeFyZpvP24fxcoiERx1zHzWCOcJgwGA/PoKfZ35oQXX:jWgBpmMO2X0g5oQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
37c1706b433423283953ac223dc00bc5f0e2c3153d3553379ef9d219df9cb0b0.exe windows x86
3e47dc971afaa73b21593aa98889447b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
EmptyClipboard
MessageBoxA
gdi32
SetViewportOrgEx
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
SafeArrayUnaccessData
comctl32
ord17
ws2_32
recvfrom
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 695KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 492KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 924KB - Virtual size: 922KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ