�:|��T�4�92k�n��#��\��e�j{�̍��q�����9�!a�c\���`��� 3�0����'�y�Y� ��9�Z�}����Ux��V闫Y�.��j@2`7��__F���e<A ۩�0�N���5aR��I�@t�O��b¹�e�;J�>��_F��7K�.6��\b�r�R�ͭ>0����x�$�N�!*ux8S�L���� '�7Br��������﹏�!���g(��k*������Byz���m�C���'�U�^��&�C&F��W��63ds!��b��l��>���i��R `�]*p�?Td��G�,"�؇g,-�������Vy,�.P��6V.�Nˁ-�(��<��P|���A�싆M���UwB�ld��Ƹ�X�����qc�.�_�.�W=N���P�#��@Vk}a.��#�.�OBp���D�����R��W(L��/!1&�Wol���� ^�{,J�1�,O� >��8W�E�#����tO��^jHv��p�nFs�]�!��ۦ:�l�OR�Z�����}��A��3a��,d�{\�﮻����[�hɑ ��� 5 ��?��S3�}���2�Zư`��<[�������}����_ב/a�R.���/��+�q�7�W0@�35�����݀�=,IѤ�'8"��-c�6,A`O�]h2������Q��a!Bo���~�D_��M[�=���o�\@0PI���� <.�Y�dBx�:�� ��t6������p�`�V���杩��7~��7�ynH<�s��;je��)L�yP2�h5����5U���c=Nܭ���I����JZ�("��Zd�F����5��?��ɇuS�tK!��کI�}���ӏ<KnHø#J;��Ȭ�3�/����t�~u���23���O3 a�؞�����i<�/2��&ɀ��A�R\�N�s��S�!TD�h�c�$�L��z�x��������Vbb��(OtL��Sow��,��r��V�� $c�ϼ$P4��qX(���>YӸ�BT|X�JO�ݬ����A����hz/#�2i(g|�(��6���Yթ�8̠z{����˨�2�BjKnY[�4�=���M3�/'�QuA8N�+����{@��n�Uy�ch�G-���𪩕sQ���9�Ba=����Ƥ�f���3�@NЃ��~^p퐛9��PӢ��a4{#G!� 1�H��W1�� @\�[���qF@JS*�)G|��X��C���V������ \k�d-mjv���++��^��ҿ4y&S����l���dg%m3D��,N\8��B���z���H6���f`���Y ���Ҡ�Xѝ*�_��%UU��� �����ؤ!d�Y�Θ̵�Nf ��3#�:5/�V���ȁ���}EO]5��e8����AC�h�D�p:� �aU��L A�69s]�ύ��o����_�z��tԸxV�.sM���C��N��~�]��l݇ʔ��TXz��.�"}�28&Ye� 4֍�y�k�g���𡋝�����G�3˵ЬGQr�=F�P��uqB��lk2� ��q��s��U�T]�M�^%K�h�Hv���H�VԨ���dM&y�l�K���n��Us^"*�]A�n���h�(r���EIl��+$�p6I^���ӻ$__����xG]������Jڛ�F��)]�S�3x;��xtv:\�e��T�l�B��A��W��M ��*8�Q⨸�kP�đD������K�h?����Z���I���)����T��»l��͠��'�c�}�����}MA�?�5X�\��W�Od`� ?��v�آ4�����ڐ��d�K�{ꊦ;�(V���I��ʃ9�5 =��?@[B� �<{� Y���郒�|������ ��+��t%z�]����]2��A���Ap{����q�L`"���1��$$��kлJ�M� t�W��7��,r���A݇����{p�O�����e��c��v�r��k` T��O)��E�L /�Q�x�Ju���[ʣ�mW�Q�B�cEv�7om�1�EU����7�ī�@�@ɪ��!�Ej^}Tj�P\��k#�{�22�D�c�Z���.�梗o��ٝu���� ,��g�bL� � ��W��vt,$���ځ��J�;��ڙ���'x���i67�,nC%�ta��� �/;���he+LAi �HIr���Y7����).ƭ�lK�j&4i:ˌ�t�Yeӛ��r��JV�J���)�(�Ok�ī�������,9[�����Я��he+�:� �Ww+�t�:�Lqn�R�z&�5��'a��+���*�� ��_�pn�����g{�e�qy��ح\уb�P�2�-q�����&0t=u��w�%LX�2�r�X�O_]��ٖ�����д�{Ό����y�Kw�Z��e:�Ԟ���b�Y�.ӆ��*� �J#%���V;Lb���D�5T4���Nh�_�f_�t�47�_D�FӋ�5oDϡ��p)���e�0�S������y���B}s�^��撴�2(�j�25�mtޝ�o?������$����Һ�� �1n��j9�9�o;�\�14�7P:NW� [�H��X|e~��t��P=]���P�Uݗ�'���^��IW�:�� �2��}��K�ݑ��?�FY��=�L,n_v ���6.b�}��y�����О��Yl���æ��� r��X�4�5�DCk"Ճ��!��.8���&���'m���{�����k��-6��p&��7��W4��Jx�k��mZ�$R�x~�N�ڽ��� 9z�-�K��hY����ތ:���_��@�:�O��D�zҥڌh��s����&uJU���H&�c�G*Y �n}T�MZCH��H�"�A�d�$�[����ڛ$sH��F��Lڋ!����R��!�o�ʺ�Og�)�c ^�(�e��<"�$q0u}��R����>D#� �ZR�此@��H n�V��z�Y������(�۩7&�m�Ub�X8�U�O�l�J�/�4���F�Y*γWuct�� �v���vJ1� \6�=�FqB�E��Ws�
Behavioral task
behavioral1
Sample
e542c6e287ee2f27e761d5f8b92d6183c551a6e8b7dfcaca95322b0f715189d5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e542c6e287ee2f27e761d5f8b92d6183c551a6e8b7dfcaca95322b0f715189d5.exe
Resource
win10v2004-20220812-en
General
-
Target
e542c6e287ee2f27e761d5f8b92d6183c551a6e8b7dfcaca95322b0f715189d5
-
Size
1.9MB
-
MD5
c0f6225859658be4ee59bdb94fa36c39
-
SHA1
2570c1196ed7cbe5c9be3c0d557945672263dde7
-
SHA256
e542c6e287ee2f27e761d5f8b92d6183c551a6e8b7dfcaca95322b0f715189d5
-
SHA512
741272b14347deddb58dc6e46d72eca4228e341216e33ac3ab7ae71d5ec07f66973b1821c7adb6a5eb6892c97f061b3d5e71214e44a111b60955f9e8e0043812
-
SSDEEP
49152:3du8KWVqgbC6UwvKig2j2N6y8/+Hjeq7pmCmgwbT:tfKbgbZ5CehooHgwb
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
e542c6e287ee2f27e761d5f8b92d6183c551a6e8b7dfcaca95322b0f715189d5.exe windows x86
3a67ede38d04095014e791681096a314
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
SetLastError
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadImageA
gdi32
CreatePen
winmm
midiStreamClose
winspool.drv
ClosePrinter
advapi32
RegCreateKeyA
shell32
ShellExecuteA
ole32
CoTaskMemAlloc
oleaut32
VariantTimeToSystemTime
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
WSAAsyncSelect
wininet
InternetCloseHandle
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 480KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 591KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ