�X�n�o6�'�����Iҟf��X'ʋP2�ȜuaZQ$�a�)�$��ߒy����8���'��F���/��tg���Y�@������XoR�0��X�n���69 @����tO�W�k���zWLJu�g�)����;j�^`?#х;Ѡ:~���#h�͌�fr�_���)�9{?�MZ��V��P)���lDL)�Mveg�J0�l@f�Fκ��"E'� #U 4 ��?��������=H�k����)1�`/��K��@ǃLe��+ݍ^�A!�� �]������ѹ�Y����(B.L��D#K��r� �0�LU�[�$Y�R{� �\g�v;}O�{0�.r�G��� @=���f�*�GqdY�Q��l,�<�6ž`ץ�<���@���O�NP���y\�7P�<��Qwk�&�8���MS�$�I����`�W��rC]$�.ޤ$�V<O�z'eK����;���fD�g��@d�Fr������#4y�)�>��q=�w�fD&�W8X�v�`71��"&��[��;�*���u^�����'���j���Z6�l�d��Ԡ)���َ��qz �`�*}�����ʊ�cf��ף���Cj������t�H9vD�?C�̺�#�w���~s>�+E�ˁ՚¨�Y�o��xᕚm ����`��:�]�$���6��y���f�[G��4�:�t"�\�w|e[�d�>��:��.'k�gI�}x�&A�� $KL�0/��$����W�$}�4`Ayr��Z���R<���LO��: 7u���%���ʧ�;w�md�J�O��NM`���䂶`h���[�@ut�����x���H>��x�$���n�6˴ �s �����!�i�QN�V$�E�������`��!*;R����8r �f�0�d���H�4Lт�4 ��{��T���1�D:pN�Z��駇��U�� $����N�-��a�T%�97�<F���eDOF�h��z�N�tfΖa��ݐ���P���(}���)��^��Q�x�����0@�&�K�t���Ͼ����n���E��+]mMH{�K�� I�ih���R2��h��%a|cG͒F]��o��b?y�������{���B'�,A\���?X��F��O��K�D)(���*��G�M՚�l=@��i��1�]R����bX�P!��yzky���)}�x���T���$�r�R��rAO��VѴ�_��jW�sa�7��nC)��9g�{�F����/�)wF��&!%3$s����X ��=���-f�SK�L7�t�0���;鱩�9��.;�G�A/S����A#V��63�]Y��O���hP��!��3�Ƞ�ٻ����|@j�G4r7�a�(g��5M���Ra����V�d%�o:������"�[����ߎ���}�<��Y�ћ���2 �?�a�c⪺B���'3!�Z��4�N���\�r%�RW�����7�\��R8<��,L7FB:��]"B�I�BH�KNLm�#Vc��-V2-����v�\i�9�&�t����Q�Ԇ��kL*���].#��kq�����Պ�!�xt���i9}V�=��˷�ބt���^�/*Q:gg�^�<@�I����r'����%w�l�M���Krk@"$�1aʿ���!T7�Q��E�t��b��H��{Ğ����&��IN>�E�>�g��7W��8��R^��UB�@m��#{�溟�$~� 9��0x��o������iH>��n��%��°���8��O�>B�YJSx��,p'4���@�y2Q����*X������5z�1~�ŗU'���H6Tpኡ�a�AR7�-AU�Ҩ�>��8^�W�t��7X��<%Oaci�G����-�T#�D)�H6����t�t�flO1oZ҉$��^1Fk�GQ8pϣ��{(�R�IB�8��@��K��R��6s^ag]F\���1�\�6�/ xN�Fw�5T'C��jZ�mt`�<�&�'`x�I䂵���Agp�^�|�*�æ��e�Dm��#%�� qN�5���e-�+߰E��Nx��|.58���~d71�f�g��.$����il)&��U��|�Bb�s���sYNɇ�Z��V�v�I�D�1� v<n/lrga��W�Z�+Ut]q�@c*�N�a� ��ݡ� �� ��9ś_���1X��w��Q���{2xxA��@�2�}>J��\��,��&��Z��z�����u�(�j�՚��d^��N/ ^��/�$�^oSמ���R����Գ�ǿ|�l�Z�5i�n��gѿJ��;p�d�/��@�f-S��Jsj�y���W7��S��,��¾ ���U�r3Վ����kw����!�]+�h�ŦĈ!�)4a,^l�� �����5?G������F{AG���;K4J��yi��F��f��@�Z���2�Z͙�Ƌ:�LKI��\L=�K��u�p��ݓ������A]���s�x�+�Ȗ�*�П�=彰�^���j�����-N9�/���W���7tx�`����"`z"��M��n=a����G��U�^����h������?:)�+�_+&�����t�o9١�]yb�`����mo�V7���dd�k�����E���w+�d ew���) h��`a���xI�V>���"�/���w!Ԡotz��I���Ӯ(���� ��X`6c���"ӟ �X��"��4 ��HD�(�A���9��I�� �U2Lh+揀�rZ2�M$�cs�G�f������M9Ru���V���j�B#K�����i�y ��c��6��$^a�'��.tB�6}jDW�%+�Nq�� ��a#X� ��D��4 �Bi+������<�J@SxeO�%���n�$�>-L�������(�K��]���!VɄ`�v�:���e�����ݢn@�{jt�{���]�F&�jW�� l�z�$�9}C#_�I�W�SnE�p���q��T h��6�@ ��-wЯ��s��{�hak�� ��A�bP��W$֪����W��Oɴ$�H�9ߒ�G���[���<O �3�Q� b�D�F��aè�3N��Z��)�g��$���x��s627"�|6�[�I���^�!��
Behavioral task
behavioral1
Sample
abc38997f40eaab98dc17cc8d237ddf626ca20815cddd417c418d404e1ddb1b3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
abc38997f40eaab98dc17cc8d237ddf626ca20815cddd417c418d404e1ddb1b3.exe
Resource
win10v2004-20221111-en
General
-
Target
abc38997f40eaab98dc17cc8d237ddf626ca20815cddd417c418d404e1ddb1b3
-
Size
148KB
-
MD5
f3f7b4974230ec947c2d3da26b5c749f
-
SHA1
79ff3a584cb1fb1ca3feda3ba179c94839f8775a
-
SHA256
abc38997f40eaab98dc17cc8d237ddf626ca20815cddd417c418d404e1ddb1b3
-
SHA512
a36318e847b25c93f30f8d1a6f30bab0438ba4a59ed15a86600b0d05b24e963df21e5dba615293bfd4eacea24cebe8464e7a4bf696d385d68b33ec8a07675a61
-
SSDEEP
3072:PjdfDSjPIfU/Z4w7iUqiJ4KEi4afTl2Vt2Sh4HsKre4q:PjdejAMOSqiJNEiRblAtB+MX4q
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
abc38997f40eaab98dc17cc8d237ddf626ca20815cddd417c418d404e1ddb1b3.exe windows x86
5e3d61bc8e18a1860569a5276925cea7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
__vbaVarTstGt
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaLineInputVar
_adj_fprem1
__vbaVarCmpNe
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaAryDestruct
ord593
ord594
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord520
__vbaVargVar
__vbaBoolVarNull
__vbaVarTstLt
_CIsin
ord709
ord632
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarOr
__vbaVarLateMemSt
_adj_fpatan
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
ord716
__vbaFPException
__vbaInStrVar
ord717
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaVarLateMemCallLdRf
ord648
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaVarCmpEq
__vbaLateMemCall
__vbaVarDup
__vbaStrToAnsi
__vbaFpI4
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaVarSetObjAddref
ord617
_CIatan
__vbaStrMove
ord619
__vbaStrVarCopy
_allmul
__vbaLateIdSt
_CItan
__vbaFPInt
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581
user32
MessageBoxW
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE