W�F����?�7@J��\h|ʮb���G.��g{�.��[����,�C{��E�Du�jw�/oz��va+[��|R;��p�S~�<g3��M��/���s�:͍L�����������ˏ�FF�����>X!�wr��tυO�y�*j� �*������ ��ۃ]��`V�~���#݅��m�����(�;�����*� _�?#W�?=��k%|@����2BBC��%V+k��t��l�8�>��r^�麌��=(!���r�g}�M��bZ��ߙM��A�aG���]n���)��&�iE�;l�9�0/uS#���"��yb�e��O�l{r�p1���%�Ζ���4N��C�����ͩK�� �! �CX9M��PJ��9��[i��# ��LV���|�N���!�E tjL&��mK8��/۵2D���(.�7�lD7T>j��ȒvCց�?sǝ�-?~��֞btu��6�h��NX�B����6BG�-��+�in}ϼq�>p�E(f�ŹAzm$�j�5c����5���-k���d�7ڳʞ��Pi0�E=�:�tae�'J�ip�t��N�>����Gb��o��7�m3h�sʨ��d�8,J}�s˞���V>�3�N��z ����F�sǛ��i�,��M���nk�J�5$ڼg���c\��b[���w7b��Ș���:e~��-w���a�/����q�W�I �C�Js�0��z�4C�����- eb���������143ȣĢw���o�A$tS� �����v���Ї^�{�� ˳(�����y=)�_�o^��Fo���2��6,BgIu[�ɨ:�d���߇� ��Z��4Z.�z�!��M]#����f�O�<��k�iZ���d�hB���\�#�9�ty��������5htʹN�����I�s�ҩ�Õ���3B�����I����"��^4������ "��"����ca�/�o/����/Fi����[�W � �f)�$��$�Yp�2��lC:�m��8x��X��9�25��0e�s���&Sr���g��bQ_.�GV!��Q �����C?B�X��D�������_6] ��}��2u��C�Cɹ�V81D��z��4�te��8�䐩mޭ�9Uuy箬�P��Q9�6�f���P���n��m�M����k��=�G�6�-Ұ�͉�t�+��������$��&[��ц�N3�rM����6��D��2�����I�D������:c(��@ĪJvorE��cT���wf ��3�}[:��r�+����0C���GW�a4NZ�� `�����f�Q�u����*�)��t�����1Εx��>��m����HȆ�EwZT�q���(E�4��1l�����uO5��;"�Mw�1�d��?I�v.rzA�ٵE/�_�-ba�G�h����F#���]��[��O"��qY�s}�Kc�<Ր���%|^>����CF���j�Z�Ә�Ï/<9�\@����-;�_�L�A�� �6���a��g�G��a����T ��y�_��/5�1�Z��Ը{�FD��5�#��B��.%?����w$y K�?�e4�Dy�þ�Ϋ�Y ����C�tzp�<�q}��<m�׆��EM.x���3S�%;�YW_�/�h��#yu�|���^nx*���wN��v� 4ә�5�P�G����u��d�W|y��6�q���O���#�#&�wx�(瘫c�B��g�[zAņ:R���g�-����L�+4���r��EKK���[9�!���*D�"��L<�;9p�L4�)v���!����8��0�;����uVFѦ.jx��0�� g�ɳ�Q��f)�`�j�+����nr�����UC��AS�"�ϲ�t ���CYJ��t���i�G8c]mMJ4��Q��R%*q�z+Ѭ�Sd���� F<1)��]K#�{����*��D�/�Gaul��4��TgC��E�=�]����t�쑚g����b��3�U���-ވ �ߗ�xFhfk�3��x� %��Lk��l*<)W�5��#(������������J������e~�^�.f�+i�jBu�=P!V��g�3�@���ȤL���`���+[���$^E���>2�9��H��J� %>W[J�T������u����o<�����1�Gk�N� ȶ}�m�ح'O<���r.7z�ǜI��J��Fo���<����"�Nj�O(�mF^LqX�,�~� ���x��������k��2=r.H�e����Y�(�1���J��V�垻��`-�U�P?�}�V.� ���`���9�Km�����R�R�<]KV.���19:���`;�"��1�E���,��aP��6M%��'Ψ����ȭ4�?N��9�ߌz �M�t5��k}B0�:��c�`��rr<cѼ,6@����xl��P.��r���)�۞A% �Jl溗�;KSO�!��� isw�L6���m�y�i���ڋ�� ����܁��8��na���} �E�dj��, �h�a�����/��V�s�(�E�3�.6��|�r�Z�L�,���=�S�#j�������[v[���DVe��L_.�hq�V��r�V"��'��y������&�����R�0/z$�P��"T�ąj6Y�v%X���f����@Ę�=Nj���?�0_��|�|X�ErL�DWf��g����#��n��OGv������fš6t&�����5����@�ɯB�~�k槎I���%!�a�]�!1T�~������ծ���6|�3R����3r7�"�����l,=� ���������i 9�z�A7BY�ν �C[!ob�$�~S�_n����R(�������k�{t� ��������|�`w�+�ף.�pc(m�,s���%f���3r���ʁ��LG:(�!��) ��ބD�����:u��>��-�NrR�����]O;N�䭸I����5&��AVe���_�<��|`n�C��0���w���F �]!c|9�7�7k@W�8w ��c��6��l*�ŷTo���h8��ʉ�ڌ����d¯Xi�F[S�z��H��
Behavioral task
behavioral1
Sample
78448199bf7bdaaeaeda6bde289096e89536389c612f9fb45bc7da4c4742a447.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
78448199bf7bdaaeaeda6bde289096e89536389c612f9fb45bc7da4c4742a447.exe
Resource
win10v2004-20220901-en
General
-
Target
78448199bf7bdaaeaeda6bde289096e89536389c612f9fb45bc7da4c4742a447
-
Size
1.9MB
-
MD5
eb293ffa03b6e476a021757a32211631
-
SHA1
ea17a16077abc927587ee4089c5bc5605d39998a
-
SHA256
78448199bf7bdaaeaeda6bde289096e89536389c612f9fb45bc7da4c4742a447
-
SHA512
bce54cd4a6736d4abef83b36b90b57f8dd14ee696fa1bd61f25e259bceec76afc5c72132126f0a58f63d25ce25e4e5308b213ed083bdd6371eff80b1ff5d1f08
-
SSDEEP
49152:1KLG7uUXKcDkp4S+dpPGIfb0Es15KLHHw+VzYfYhs:JvPK4HdpOIf4LCnrYWs
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
78448199bf7bdaaeaeda6bde289096e89536389c612f9fb45bc7da4c4742a447.exe windows x86
0b873a59a2ea43a2e5def3e08c98de45
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamProperty
ws2_32
ioctlsocket
version
VerLanguageNameA
kernel32
OpenProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMenuItemCount
gdi32
CreatePen
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
SafeArrayGetUBound
comctl32
ImageList_EndDrag
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 634KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 257KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE