��K:�dz�n-�\68N6_� \OE<6)k����c i�&�j3T5����q��M$gIP���w��?��L�B�T��2�H����hb-}(����V��o�+��C�m�&e$��^`�y��G:J�ƳDS�%�!�<�*q�b���H9�x�@((B��U�`�up#���� `T����2iH��h�CP�Dж���z�lX �i�;�;�N�/6��*�o�S�����I{����.,�vDC8�,�!���Y �ިUC��rx+F#��9�ظ�XVqқ¦��w�ǃU����ɺ�o���jA{瞪UK���f)��4HD��[���W���D�0�u��X6r��ɽ()��Op�Z[ޫ�x����������7[ɨ�C禆å.\�w..9f�k�"+`i��1��O��9K �e��Jl�D����q$A���K����?*�i�!��p)T�]>\��)~���~e���{n�A��3b;gA���E�g;(GV���$xOG�pG!U���I� f���v���n�8V�i��#=��Dve�ؖ[vI��qWV�XB1f�dV�^���]�.��!�P�9Ė�Jiyy��ɝ;�9A���;2,.1��j�����2|� �.t�H�'t�F�� ~����|�,�T7�L�#��-N�H����4L�;h�ð���[���ݲ�ۏ9��<��û��5�\�>s�V�.�腟�}��L.�-$��z�ijͨ���z���������G�u���ڬ��]�!y���b��(/�<j��6���2��/����3�7ϫ��h�TJ�x��G��XPbZO������>0�('j��D���(g����fsRЖ�s�7���[�5�kգh���_0���j��ZYRnع��+k,@m��{ �XM���~S��Vh�wOXg����C��|��t�V�fbS�����s,��E]�����@����N�����bx��-\^+oE�u����Wo *��Ӽ���]��j�(��� ��d��d'���<�t����Hx`�5=[�j�Ih�k�G������*�ݯ� �����K�q����l��1/[H�ɟe��c���*���I��2�d<�5q\�sǤswK�� و�w�@%:w�zw���1(F�"Z`.\sh��4��~���~�� A�b,H� �/d��v1�����*R�3_1 jLc ��BII㮐�P_��/x�=������� 6�\� ��_ͫ(��s˺���]Ồ_D?��}���&BAW=�}�k��^)�u�ELw���n�tt��q!)n�s���oA���?XجC�>0����&�r�vU/H�6���Ӫ*e<�+��JOq�e��¼����E\��io�����6hZ���S�E�H�t�7����<��&r}jH�VA��l����D��[4'�=�+���3V��֡�� ��岃��ij$r��4:��t�d�{�yE�kLcT�GL]�Q�6}e��Ák�0���,�����(�%,�s�+�(H����f��g�bK(��)��L`]�)�������H�a-|�墔�ps骤%�mߓ�w�ȶ�H7�0;��Dh���.�cQWE�3ʿɵ��d6�A�]�}�W�� t �(xUa�u_��͇�c��ܯ:�i�8�Ѩ횝P��W�;c�� bw��!�Q���-6�n����4c����wɵB�N���^r�9;������Ρf�8�@wl�+jE�_;�q�%�(E������&Xލ��d��kO�}i��e|j��\�0��k:�J��Q�zFM&i0��\���h���۴S��רS�ao����/�$���s���yD���'��za��ܽ�Q�r�4�O�]�t�y~��CL�Г��+8�8��u��}��9�v�Rd�ӡ�~mي�R7����������ϲ���{��/�;��B�Xm���J��H�,F� F���b�Kh8�>w����;!�y"A��ņ��k�L��(��dΥ��b�Z YxN�����|�!EA�?�%����t�ƚ�M���Z%US����dG⩜ M��,��TQ-u��ydR�p m"�a� �uyW�����Ǥ��fa�A��{ޟ�v�*�-�2���{{"��/j487x?t.��"��H8�T�;��P�R!��(26K�N��W�@�<mk�%о��Z�HY��tdN��Ϲ(�C"]3��&c�����B�Q�;l�b_��5s��h��IzǏ��/�LХ���F(b�M��MDÄ�C�uTs����Sģ)���s�Ƶ�!����&���ޖ�y�L�/�>�p+��7�� a�N��p�����T��+):=Ʌ?���9q�[�����v�'�^9o�0�Q�9);R�~M!�;��������1�aSݔ�ď}��8�l�]Br9!ߢ�NlN� :���]�Ա�����g��N�4E���.,a`nv̟��7뭤>A�c)eY��SAA�i`�8>|gtS���+�����a���I%q~�n�B�t���nqwQ��PS���îU�*�?+�� �#c�;�����}4_�w�����#%�)���J��ӛe�]2����Jf��g>�i��.����E��~r��X��)��Y\�a�:���x�cgW+(���y�]r��H��8�4r��[��W$botS�h�)�\� �܇b�P��7z������n��o��F�fIIky[_bJ<��s�f4���3* |&p�c3�Rrx%����z���-������ ��=�Y[��z�[%+rGP��P>|Db�83���,ڕ�d�qQ����mX�aA˙lq��ym�ٟ���Ew{��eL���0�D�N/��l:�)/w�k��,���~�h`�a�v����i ����r����'?��%�+�u-JmP�F��x��X�Yh�Mn�-�ƭBQf��O��*����G�#�LR4��c�V��Ve&W>4�����������4�10��R�T}^!d�� u*|t��D%�!D��D�;������ߠ��W�9����b���.��U�v�,{�a�?�n'���z�r^��%�Io�����6�Q�{������u����{��dhs
Behavioral task
behavioral1
Sample
fd5f32e8927c729e9774a2eeecfbafba3155f70fbf381da03dd1471f21880c72.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fd5f32e8927c729e9774a2eeecfbafba3155f70fbf381da03dd1471f21880c72.exe
Resource
win10v2004-20220812-en
General
-
Target
fd5f32e8927c729e9774a2eeecfbafba3155f70fbf381da03dd1471f21880c72
-
Size
1.0MB
-
MD5
2739ff2319f1b1c21309550400548d03
-
SHA1
87af89ee4c576deba83cdd0fb2d7e89a79dd4ca1
-
SHA256
fd5f32e8927c729e9774a2eeecfbafba3155f70fbf381da03dd1471f21880c72
-
SHA512
bc866b240bc4a67077a2eda331639ac3af2beffac3fb220544a145b9b8f4e8a9e28f57602f5a7c322bd73a63d2b59ee5639c65b1883d529546580fdf1887c07b
-
SSDEEP
24576:lqEgW1ZieN04m6/t88zHJhJ4cnmjVoRQU9DH:lqEgYV0nupnbnSVHaD
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
fd5f32e8927c729e9774a2eeecfbafba3155f70fbf381da03dd1471f21880c72.exe windows x86
9928281e1c4986322a9712b6334f7c23
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
WaitForInputIdle
MessageBoxA
gdi32
SelectClipRgn
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
sendto
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.textbss Size: - Virtual size: 885KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 940KB - Virtual size: 940KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE