���Q��8M�o0֞��՛�%��]���.�0�|l�H�>� [bJ���j�s�,D������bR�F�8�� v�E��m�)����H|��,�I�}S�00�Y�>�%T��֣J��������!��2sPwnP���F��s�oh�x��U���{ Y�Q��:Pׂ����t��@6����8D��R�����Ԧ������d�r.[��XЀfկh�#^�r��l�o��O���(L-侢���*^Ջ�˂��Saѭ����� �i1i�a�Z-��H&�&��I˲��1��G��SO�$�W��y\I�)��I�{�)�À�ޙ�;�� +���S�;�7)��Y>��m��W�����J!�m?~M��F���(Ø���f��a��N������'@St)���~��m�i4e3�F#�㪌{����Ъ��N���E�-���^R�q�>�!��O�_"�{G��p��7a5W���?-�b2���Sr@��Q��<�f�m��簿�C�̡����Kh:[�q���1!��y��ٟz����NJ���S{2+��n�~xG��g��N\r�7�uNJ�U�|��IM�#��r4�Р�6Cђ��gG�c�M$WL�CA~Dp.uRg�[�Qf��Os}��E�>��ۜ/*y&Sr�u�]�/fNe���+�b\U�v�}զK/W�,n �<hµ�p��:�UR��������vʺ��e�6��}4�m�֏�<Tt�2�_�B~$� c[,rC��hn�b.8 b����s՞VX��>���ئ�{����]L���ɯ���;D6 R�d&��Ew��"a����C�M��d ,��캩]>����8�U�e��6l�m�Y:t�+��(m��M*u�퍯�`�Z�rٚ��� AP�6�I����8�V=��A� �s[ �l��T|�3t�ּ�i�W������9��ٷ�@m���ſķΆ��\h�D ��"�KI]rS��K�OR9� O���"���$��c� �Kf�|?�y+4��-(�n7m�p��|I�P�Kk�U����5��y�''��,(�ׇC���>n'$Ms'��P�n>O���f~5k#\�r�V5ȗ�*��Ȝ�^�1�3R�Ë���8[�0Aw�Hlъ4�.���8�N��-b�x-�Ϝ`�G(�ր�U�7�!p��̖5I���=R�ۧ}U� �� ��}�o]:���BZ�!veXK_>7�&��:�h��D���Ajח�_�l��d���>���GH9��vr��&�L*�D]_}.O�#�����3*,��o}�y�}Jh(7����J�,J��7mӕ]��~ l�-<�q�ݜc�&2��]>HXI�����G�I#y�K�Y3���+�ѲAh�تLc�����]a#+4v�O,���s�;7��hs���� @3�Ӕ"K��6���~�V<�|b���O���VM�d=�~� 8�ZA��D������< �PP{=v9ˊ��$k/)��*����m�P؆! ��5�`��xw��-��0o�}�r��b'/K����� �<:��S� M�Oˀ��g�E#17V^������CZdz埸�V�ό'� C�uj/��X�'�8�s�|y�)���i����a��*8�v#ʥ�-~S���C�+��eJK#ސ?T{u�$�J�q}�^�mqp�s;FF݁���CgS�Y���0s�L3�m�������-B���kY�K`R�~��E �U-���Y�e��n��zUmh�PS^����e��&g���J��f�m4���P��W]@�'���U���#�o�#�3��z��؟�z���:��`��\�.t�r�K^��1��#p�&��}L:�(�}CvUu���Dx�T�)R����v}Wh��K�e�C��hB�.�\�'����=�N��{0�_�ܒ��/5K%�*����Kz�ϻrW��َ�mf�z�k�Fl��ʞ#�,�.mJ�����������]h����� f��vF��:������'Yn�W���S�Ut�Z� �{��#���jw�����m��Q��oytR�Ä{������ޝ�w��x�̾�Y����I8��i�B%Q���N��zF�9@x6���f����a��F���Ty�Q�!+TL�-���K��`@؎FZ���b:}�INLt3��-tL��~�T"�μk�ᚲݯ����������G<Y@���)�R�(�t��领t �63T�x���q7��Pf`���r"(M��2U.��sek'�'������&Г���l�䦶��{�P�S�����"�/|�ݻ����ѴX� .~U���Ū��� �B���L��%����|�3����ފ�j"_tO��w���n����^#"C��]�5Ŷ��0 z��6dc��ޖ�������-���A�xL�<���9������Ck��k��P[~�n̔|�I�3,5�1��QZ��`\�߃�^:#3v��Ë�D�nd����N�����R�K��If������1qT�y��q��I�i=�>���G/=|]��KVS�Y�X_�/`gւ��tL�7B'�9�C/@�4&o��ܢ��B�$d�Î7��oOo�S�^���=a�C�c���A#h�9�!9�\^�l=:dpr�n9�3�1w��+VC���z��-�x+��W&�WoP��K�s������X�Ñ[���09��X��_x^@����±u]����0wq�'�� ����~�/�]DA���$��G���Yqgp��+���0��P��w�n߈)_u�M���@���H�q�M���&T&;5T\�'�x?��`��Ϫzh���]�ex��up�n��9�dh\UڝI�l�L�u��SȞ�W�媫q �(��Z�&���Z�`/�r��2� ��Z���.��87�9D7b� Ƅ-z�a��c(�H6�����~��\�B � ��}��T:9h����r�&/��^ o F�6�h$e�V�CXϗ��-~��NF�s���� �j�!�e{m�gOPO�_�Z��RI���<l�)XHI.�����7[j�N���d~k�ń`-����&��λ���yA��ڄ9��#LH�T ��������ѥ2�5���r\����Xl/&x
Behavioral task
behavioral1
Sample
e41b01f49d323b306cd8c198d7c861b242ba95f33c8e9351dedf7747ab5740da.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e41b01f49d323b306cd8c198d7c861b242ba95f33c8e9351dedf7747ab5740da.exe
Resource
win10v2004-20221111-en
General
-
Target
e41b01f49d323b306cd8c198d7c861b242ba95f33c8e9351dedf7747ab5740da
-
Size
88KB
-
MD5
e63e897f4e526b0faf814e8d35938487
-
SHA1
90e9c61af7e6371ef8534576d7a354dbf33a76ff
-
SHA256
e41b01f49d323b306cd8c198d7c861b242ba95f33c8e9351dedf7747ab5740da
-
SHA512
e98e9448c8f898bc89e91492a3dc924d9e16fadc05aeed7ee1e5077dfef61d2734443e58bcab8e7451268cbfcb014007ee9331af204f04311a85440c686396f9
-
SSDEEP
1536:pDiR/abnJdQ3Kk9Fykn1Q5ggbaAmHOrZ7SVR6BAmgeDE51:peR/KLUKk95nq5xbuWJyZm7I5
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
e41b01f49d323b306cd8c198d7c861b242ba95f33c8e9351dedf7747ab5740da.exe windows x86
4e1f9c837a4ce7a9981d59cb0f398296
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaLineInputStr
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaExitProc
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaStrFixstr
__vbaBoolVar
ord520
__vbaBoolVarNull
_CIsin
ord709
__vbaVarZero
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
ord648
__vbaInStr
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaUnkVar
__vbaVarCopy
__vbaVarSetObjAddref
__vbaLateMemCallLd
ord617
_CIatan
__vbaStrMove
__vbaForEachVar
_allmul
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
user32
MessageBoxW
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 76KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE