W���D���г�V�Z�5�&Ӄ�:$��x5�nt_�[EE�6���[��3 �)����]�v���U�M�}r*�놩s'���o� ߵi�� J,w��3�Q'xO�7���6�wA�6��������!�Jrf8|�g�V'��'㠑����y�n�T��.�}���߉��b���.?�)�� H شi��S�b?�iM&Y^�!�p��?�轂fȌ��Z�}�*�yWwe7.I�+���@�-���+�8"st����1���{��4 IܞY���A�p�"=�8��K1�M����Ŵ��6UG�Ej���(�+v��� �G(V�j�`�8<�����! &S�i�UV��X�kOA'�&�X��V����A4иP��Y���-����ט��|������We�����Z<R���mS�E�x�T��"�����;zGg':.�ߥd��="�.� ֦�a��A��_�9 ]����#�A&� �j���z/��g�ޒ�� TC��q����W���&�?9N��+u�=y��ƜLi�n�ɟ�yc��0��A3�Ĉk�H�dʭ<�.�7�gupx+�bG�a2̡�Y� ����o! �q�6+5�Dɶ���Oj����?*��7Gm=y��6A��Λ"D �A���B�V�oB��.G�jF���w~��]��֊�����]��� � �7��江Ȯ���A'�έ����Kٷ�V���4�醮&�*k$t�ԇ���u���zO}��PMpM��>w���Z*[���]5�����D��ZItUyGy�\ע�О �غ�Ux��CY������J^�j�Ě����k����i�`}v��G���&�/��?�������fL��$§�v�rŇ�m�3fT���:�5���xb�Y��L��(=��ڹf��(�V���E�g�5l���7(w������K !��6��55�"�]�게نnq�6��$�Գ�ёZ�)�&(����5��A ���Ӊ�&��=�~����ʿ��C����'(���D�� ����1�����'��%�/e��=U���O4��<��[lW_�Z��H�Khz��D��,���H�'�������|��C�!�g1�"�BSh��1_T�������x�a����h�-�K�i��(���FJ]�䛊��p���������?�������5�4?�u�A�)��4#�y��(z������F>1uiU�������K:b���X�YR�2��>j��>��8vk`n�y���P����_����P �Ѿ�Q�@���:R@"_��B-i������q��eڬ�mD쭣���e����S���$3㠫�A�����0�>����0�#�~�8�@����͐�+3�c:Z��Q�����u�o҉?��5FpW��H�ޜ��t%v�Ge�K½wk�6^�OPԓ;Ưr����~ ] �����DC9!t�\�v�Ձ���҂���q2o���Ӫ �����It.@m�Kbf�):�����|��9E-l�!�����.�W|�]��{#yD��=��+7�7ק�'����j����X��iz0�U}5M\t+x;�v,j{.蒊�S��'��u�Sm`Yf4xk�c���v�.��,��=rJ���ޖ�_��ֳe�;��Vw9s$_��~�1Y&�������η@n�'E����ĠIP$�*1��r�X� �j�X��s�h�X�fD�\�9�VlO��RII�1pC��XE�u����h�bä��kL=.�E^@hh���΅`/���c��zp��ϋ�Im:��G��Q��|u�-�(q��" ��O���� �i�@���x��O���h�C�Mt����x�O4������̶N��j��ۄo�����T��p%�aV`ϳ�f8<�<�Lu�Ʌ0#0�/q����h̭�����:���0 %�G�AX%<��)�I��$�\V�����)�J�c��>d ?`��hj�î�ڬd��H��� /2yUJ$�NC���3�/�4|�=�\ʱ���8�������Y��\��KC/���c,��n�-:ص�:�7�!�9�d;K^�)3���lw�>H��6e'��0O� B�m�i��MKlJ�-�:�8)��=�� �i�jqU��`���~ �h�]�u����0�v=�q<���)���� ;Ӊ���j��xo����>��o��Ytf�u�Ɍ�}2��l���G�ǫ; ��ue���m�W�/����j��V�]�������:��iK ��Z";:n��K�7�qH9���Fm�q�����h˪nW�m�}O�Ej��_��om m.*~G�,~��.!ޭ(N��#�9�E@�%�������`V�+����"do)%��, ��C-�HӸ��qH�D�%ly��l��p�����eѹf:���&L���0��O�6kʕ�� �&�l&�z�mM#�O����q:���Ρ������X���VM���q`ڗ�Ei�RØ1���`���< �#���ۇn ��JZ�o���~b!��L���u�B��"���]Mx�&!������o�OH��Q�[�ϩ���5�Q��$K��o�r8��[��K곔&����K�a���A�s�W�6�d��n���+d��<Ч$l����h�J6�j�֍0�D.�|��Ҍ�eϩ�i����#[0����K�}�-�B�ou�z�������R�dK�kYw��,�)�8�1af+��_����ݻ ���k�dU��H/�,X�y�ad���k�����-׳���W$�����Mb�j ��k{!���"+Is��'x4�gc��wr�8E�lZ�@��T�ٟ��Fqh����W#�Fm�~�a�R���%8u/� sQ�6�H��A�.�BW�E[���|����M����~6��_D��;�����y:)h|����S�Є�Y�K҆�خ�pi4,�D{ >>�����V�Cu>̃��-PS.�cQ���r7�|�M����'�xP{��ci/@Yjq_���<S#����2I����*�3�O)E&�?4�����g��7|�웵�a��*qCC���A[�*2���ۢ�v��OD%���,D%
Behavioral task
behavioral1
Sample
cdb91b6f5a53b9024c5dc949ea158f080d302a98d1314b913a343eff260e66e6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cdb91b6f5a53b9024c5dc949ea158f080d302a98d1314b913a343eff260e66e6.exe
Resource
win10v2004-20221111-en
General
-
Target
cdb91b6f5a53b9024c5dc949ea158f080d302a98d1314b913a343eff260e66e6
-
Size
132KB
-
MD5
b7fedf0db598c783c2c72e32b88cc9b4
-
SHA1
29aae1e2e445ad3672b3417542e2bbdc4f9911a1
-
SHA256
cdb91b6f5a53b9024c5dc949ea158f080d302a98d1314b913a343eff260e66e6
-
SHA512
1c9ff819e59a74c13f814e765f0ef9e35b034c56a61e0c474b772b3033ca5e2a9170cfaa9ce2258670900d9f7a3a6af58d7ee05d00ebcd64ffbe8f776b13ccb7
-
SSDEEP
3072:VqHaXI/7JLTITzx0gU/5CqDSOIDB/BQtwznsdw2C:Vqa4jZcX2VdDDIdBQ0CC
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
cdb91b6f5a53b9024c5dc949ea158f080d302a98d1314b913a343eff260e66e6.exe windows x86
a1e67e3281dcc40aadac422d328be723
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
AppendMenuA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
exit
comctl32
InitCommonControlsEx
msvcp60
?unsetf@ios_base@std@@QAEXH@Z
Exports
Exports
Sections
.text Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 112KB - Virtual size: 109KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ