n(/z�CL&�İ��V�N�m-�����tDV1���jA�m� �$��M�Vn�{G�c��-/��%���pA�G��hf����v�zU[9�� 2��G��3S�Z���U�uj�Ks����t���A����$�<%)Si�.dv鯎-)@n����a�so�vr��wk����m8Cb����;�Ā��'����P�����7�N���~-Y7�@?>ZWQ\^�N�j ��Nm�>M�b� w(�!)Hr)����5 <���0��FT,[k�������w=�V�m��LZz�p����S������x�-�����?���-��yh�Ὴ9L~}�W��q����) �e'�~t0����f��f�'��O6��p���:�#�r�7?k�@�/M�<[]�E��~��#ļ=�m=�q�AeJ?ۡ����6*u�u��s��^D*#x���6N���'KZO�0@f�Fl?|�o1Q��z��?#䒪w�0 ý����d��s�¨��l#Ӊ���j�X|$���-5� ��p��z2�1�b_>�J���<B�x����1I��NJ:u�ƻ�|Y+Z� �){ݣ��$�V�:����4����0k���x�36ʿoaH��� �+H��Ov?F�_�%#��L&�Bo�'�ނ�����)Bl7��DX[3����ARD������t���CnQ%L�?�f! ���Z���";�x������ĵ��W���lz{;�T -��*��ķ�z.3Z�����$�̱=IWj��#�W)�Qr�S��~��L��CӞ������,�eM���G��gY�`�F����"��T�~?�b,H����f�?�~���<z{����I[�od��5�L��)l�Cq �/Z��>�D�X��mo��r38�(�mw���Я�?����`6��� ��H���A �2)��;�2����{S�oFY%��/�]���� e��EP��M ~$u��i�������\/Q�ܛo?I\a7�!_#�z�+�?Sr��A�=P����2cGfi���v������0��2uZ� �U��Ĵ��{�����=��w#:a�;/�b��oKH���M���j�� Z2�V/Ӑyo��g��yי����V�̙��E�F�J����Bn+�ML�w��|���m��y��Z��x�'�&�)S��b�2?�_6�*(�)2|eٱ�5l�����X��t��#������?@c-~b:������)�#п%� XG� �XJpF���.�q�6:\�x±7'F�Nk&�d>�������^]c)��|�m���]�u"sp4>4j��?n��<��Ǫ���UT\�����-�,w�E���r���>�|�2��d������J�ݼ���4���櫱@ ����z��d�;lx��q�)%e<��.f�����)���x�� $���m#5/7��]k܄�ҍ���b����1��y��U�q� �qd zB����f}7Lg�>�}aJ�wI/�(c���!��3���ո �O8?ę�� 6rw\D�w�\}5&>W���2���pwr9��b�u�2�����<3�E{������60���^Va���6_���\�ƅ(:V�~V�0��ƃp��n�;�'t��V\��9%�������.�"����륟�N:�oq��J�EUm��Δ�f�g����[r��*W_�Tn��ͩm���}�"�w���.1�ua +I�K{-�B��9dgo� k�<�"䡣ש��X�j�Q��Sm������Q�ެ��p㤤��\}2T����Ӱw�8 :�v���{�$�,��F4�u����51@e�ה��߉;D�5>I��s�X' ���7ܔy����n��RR��lKw*]�����ҷ��n��ra �Rq�xe���X��>��K��6$1�5p4b j����?�xԮu�gw��^�Ku~{S�k���3cC�\�)�g����E0���q;I���6>}��0݂�+�9H&���V��KtZ��h2Ժ0�9r��6���u�6��9*��o���5X��v�U4��d�n q�-׆TK�/-�����~��A���h��=�8�mMc�@@�G�C����<�̓�H�Ǭ�a����_&���@Ì�����}��c� *���l�կFD6[�YA���n�&��Qj_T�}�7���ݏ9��SU��#DR��gʃ��h�l:��I~�]�ܡ(rh��6�l����%&dz���}��Y���@#��� �S��Yn�� �����P�ª�>��$U�!�B!�@�^�դ0�C �=��J�G�P.f��"��6,�#tY(ɶ(o����}ﱳ& .^���=N�8��z@�������3�n��n������O-KS�������J�U�_�gi�Q��e���nt^+8�=(�_���t�1(p%s�/�� IJ�^�5������Iu,=_$'��UY��(���j�Ч�/�U�@�����y��e�m�B�i}���)}�φ@�H�U������4�Ɠ���iX��(�w��f���t��D$y�kW�Q!\�I�uC�t��3����Xa�σ^��dڗ.=�d�s�ާ�8ಠ�R�UA���f."*1z �����l��Bq0��V�#��$�M0Jfӓ�xEd��wDz�|o݃&��zd w�>C�B_I�4�ZI}�)Z�����2�!@�����/+mT<�\~ !�v�VپEK┖����ٕ�C�R����K�|�R39���OjɆu@ջ|Vcw����A{�t�����s�:_f�-���y�@<$�����IAl�_�0���h^lX�e��@�mn���S�WCc�O?���pj�G�(������Χf<n�Fg(4���}56���g�Y��3->D�Z�,"�� Lֽ?'�!�R�b ���R� ��ֵ����s�۾~t̫��4ݚO�C���+��iX��Ízk��B���ڳ�m���ۃ����������ˑꃇ�� �}�⸲�߹�(�vV��I#X���!�@0�1n�U�n���*��K��hs*��=��A��w*����n�%a=%%�q�/z�`�����h�!�+&�@
Behavioral task
behavioral1
Sample
5608195a1eb0437d4f5da59e7a12e5fc6dcc4c94b8e3e17f835d74cce1cec982.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5608195a1eb0437d4f5da59e7a12e5fc6dcc4c94b8e3e17f835d74cce1cec982.exe
Resource
win10v2004-20220812-en
General
-
Target
5608195a1eb0437d4f5da59e7a12e5fc6dcc4c94b8e3e17f835d74cce1cec982
-
Size
128KB
-
MD5
9b58cde1fcd99ae6b910c1ad2517df3c
-
SHA1
d241a94b43a3154b586d957a2b8dabef87a56809
-
SHA256
5608195a1eb0437d4f5da59e7a12e5fc6dcc4c94b8e3e17f835d74cce1cec982
-
SHA512
b58b97c78a386b97ab61c820c0eca4b8ca91c2b9fa75efa5ad48b0c16a0bb793a994e37f1038668266eede850566e3bcd3d929c3323fe6d46123ec7ec5348f12
-
SSDEEP
3072:0qQUrcCgq/DDZYqkhwryTvO7a1yrGuSV4a5qf:0Hq/CqewUvka1yCV4t
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
5608195a1eb0437d4f5da59e7a12e5fc6dcc4c94b8e3e17f835d74cce1cec982.exe windows x86
81f249549852099ec79624363293b608
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
_CxxThrowException
comctl32
InitCommonControlsEx
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 108KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ