�F���*��P�� (���9";��c�l����4�:��O�ɶ�F���� Q��7�5��e����/qc����zX�jH�\SDR��E[DT��ԍt.�� ���D����tz?��FN�1�J�d}�"�Nw";.�4 ��,4,y�~@!9+>���=��'�,��1��+�aP����4��>��쎘��,9(��~i %.Dp���#($�ВTj������|��˛���j��B�%�*��W� 7�!u��0?F�u/q_ђ��D���'fo����ΗV*%�!B�а��K�,�nn�:h���to��&�liT�AFU���~�1��~8�2r�u���,uY:+E��(|#�������(r������{gd��0�(��'��Z�� ��K����f,&�Q�k4��~�x�Z�<�����Q�Ty�~�FQf�W�) �I�8fjM)aXl����*\�g��Z�J#3Z����l�M� @���[��Z\+A��!D;����.ʮ<�n��إ��C����dԑ�9BO-���^?0��x?,f��Z�14�o�2��E��Ux�OZ�h˛����L�T\� ��� �I�\K�;,��h�R��1�[<m�f�w���X�9� Q��xa]��l���Lk<)�x!o�^I�O������eF= �����ہw�7��&a��A��x�+m"t��;=ɝ����vQh�Q�B�i���üE�%uw."�)��Bf[���#�����e �n����6)�|9ۖ�;���+Y�&`�`�����`����:ʸ���>eE;��t�U���<Ē�2�?wV�&]�-#���ݜd��m5/ %����9�Ť�9�%[σ!��Ö/}X9�������Pp��3������tRm@���]]�va�����N.F��a�$+�s�\�9O~��@�D팊�����(�!�jWyu[���^����?Cz�乢��K ���r�@���G �c|�Ȉ�U�D=Ҭ1rU��V�R�gL��,��j0�u����A�_-pH���:���e��,��)��nn��f��L ��>�*�x�3(3���Oa�������H<3 ���@�!���]��$>� ��Q��Ӆ�Zl� �}I����s��"sŕ����e�|��������F(�\��J�yMSZ���%Jy��|���6�?�6��gKPv�pj�A<�&�v���J�EP�d�P������ k�Y�dc?��1�ȟ��R�~�4P�Q��]#T����f��z,|q)�.-��]�ή���y=������~z��c�O ������!7~C�O5��U �h��Fw!JJC�T�/ʸ7��7\��\^[�'��S+���'�{wd�9 U&�+�/{�;�*��������X���1� E��}� �g9���M� �Ox�-wc.�k��\ �a0&MS�7��m�@�Z1)��ȑ7�6}����F�Y�F��V�~s����5�#5�r�TAjf��}�b��� �Yܪ�}��,�p�v��a�+�����E�e�BQ&�r���Y+!�nD�eU1��-7k01�C�ڶ �Ncg')J�<r�� J�8_<��9(4��Q�K�'V.{͵��`%d���]�Kkmk�+�+{���/�A�G�!('o���e[��w�;)��!D��ҵ��c�\�j����l��<���B ���0��\�Z��Y �j��z�\z�\ ���K�c�2R"���ѫ�]�a ��+�Q���ixߝ��k�`���ۗ��|PͦL8����e�1y)�Ⱦ-N�����}� 1DZ>I�������,=��<Iw��8����A��[�|�=8�!����/=��]/��]��9R�����(�&�����o��_a� Q�#�4�����߲��QN?�G�=������6�z^�S��@� I������ ��?�T��ش�:�xn5P�j � F�k�C-}i/3�����H����YO\3T<�D�˫�2�3n�I�t��l?�[�� �fv��b���+�n1[K>��r(������3�*�=��Q�N��JϘ�)��B��r#�u��ښB�C�íecc�n�x3����?e��q�5����1�N�� �\h����5�?P7�l�b&òm�K!��jժ�;!<qb6I��Ĺwɼ�h�p�:q������[k>O(��|�zK2�%��D�*�#S����*_N���h���r݊�i�T%}�DJ�j���H +� �-����O?�s�&*Ue ���ޣ�L� &[@ꊫ[v�\������߶ӯD�x�߀2D��W�B���r`�҅e��^U�~g��3θ+���� ����d1�9�X���m�D�Q�aYI��o��1���ن�>�ќz�I�4��;�{+�2wz��3�L��^sЌ����c�"�������f]=3�z���T��h�p���3�Nc�K�'D����UH������V����V٦�� ��oՇ��,���ǀ<�-�D5���~��5�0kwz��q�>�NV��&K���zt��d�>��������-�6`X��c�^U}cAJ�'��k`&}5[��6Y���f6��w/�,�K���w<.�o^nC0�_����;}{�+�)�?�k�"5�c���A�8�Ee,�!B��(��蜯n.aH�zdC���2�7��@M�6���H�C������_�hhL�?���c BЉ�c�\ ��un���j��}T�[#���` �7qL�הO���{����������q���>U&!��>Eƻ|�<8Z��Kr�� 8��*J��x<�7���{e�6���d8�v����mY9��Hv�����l/I<T����d�Q\��穬��y�oZ\�WUN66������A��ҹ���B�J�c��^����A�j�3��c����5��w�s�L� ^��J�J}� �֨b�}y�ꏮ�>B��ֲ��YP,ҩ�E���_��|C<�c�T�á�E�V�^xFe`#�x�*��4�lYZ0G��_�=����� ��r�1/��.m�:Jo���T��~t�R����59> ���Dqw�8���J]�7'��0G
Behavioral task
behavioral1
Sample
06a7b10bb9122deacbf38fe0b5861a47cf0b663134f88449022eb16b2941160d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
06a7b10bb9122deacbf38fe0b5861a47cf0b663134f88449022eb16b2941160d.exe
Resource
win10v2004-20220812-en
General
-
Target
06a7b10bb9122deacbf38fe0b5861a47cf0b663134f88449022eb16b2941160d
-
Size
1.3MB
-
MD5
32ddbf8b0bcb23ae5160c2a268dae9d5
-
SHA1
80ebc1c509f444a02b999b7382e88e1a42412a49
-
SHA256
06a7b10bb9122deacbf38fe0b5861a47cf0b663134f88449022eb16b2941160d
-
SHA512
3925c6b7b117e3c16b725c58571b3c5424ff280a5115722d53f187cfeaed821a7b0c1092ea8ef50757c975d01138231fa6ff4482182a2a1c3dfe47c361cfc3a1
-
SSDEEP
24576:V0GIpf648TLGrFShqYkQZ5KGhFSJjQIjwiQ554IxL9gIBLB8:3IpfeKrAkIKVJj0/4IxL6IJ
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
06a7b10bb9122deacbf38fe0b5861a47cf0b663134f88449022eb16b2941160d.exe windows x86
50bf913235572050775ae87ae87ad9b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
midiStreamClose
ws2_32
recvfrom
kernel32
EnumResourceNamesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableMenuItem
gdi32
SaveDC
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoGetClassObject
oleaut32
SafeArrayGetDim
comctl32
ImageList_Read
oledlg
ord8
wininet
HttpQueryInfoA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 647KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 317KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 849KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ