�[��_'���������l�+g������ۏ3���j���UMlWdЏ���-�V���C,L���r�"Ll^����� z���E�CK�$�eKצ8�[K����:��:+m��6���d���ݽL��^��Y��MRy �DRO�S��j�+�L�f=����>i6̓$_����#�ͫV~+U�e+�B�uQ 3F�4տ�98;�E��?IZ݄jcb�Fq�X��c��s����|�#4fG_��Tg�سsX��������ᣩLX;1�b�{)o��t`��Ʋ�<�ō�I�z�'+ҡ�1���Ǭ�]�<�`�½ L|n�U1!Oj���4ٶ*���$�w{�|l%��}�'��Ϛ��gdl���ו��������R��d���B�`_F`� � ��|���r5ݟ���}p{Qτp�k�<��������Z����GM_B7�䔯[p�R5�����i;�G�Z�t/֤�80��MrI�qT ���ʰ/~�1�UG�r�`�ձ��S���Z��I�S���1@�\6���*�ˋL�S^��bTm5b븶���<vsm�����K>���J�S���,n)m���0� ���aGa��^�� ��!�^+D�|`��D�/ӭ�˥K�\��������%�w5�z���ZCWUt��L��X����\��g,���fZ�����T9��j�.���H%��D7/ ��,���ݾ�R_���|a��3�7��[�T���� �����%|0�����t��G�Ӽϻ�`������y�b�b�� �G�T�����#8��yS�3��ʾ@�kN�������X�_�}��R��� �HΨ�p�!���f��fk����������B�4���%=�F3����L\�p��k��Yo%ˈ�3������]�����`�_�ɢ��h$����{�*���;�ߐl�!o��TTY�d���Y8�ي�������t8�~����o��2G���ؐ*h^l,k��=>xG%U���`�w�>�j`�S�{�ژ���ꩃ��7���xr�� ��o��;�G������J�<�dD���ǃ���P�� 8��.-!�#��r�፦�C%�WP�M�O��?�n�g��ìs��i�豋�@/�'6w���z���\kg�ɔ�ɬzn�+]q��,�:�~y%p�K��P��<Ps�&��T�G]<�Y��N��~�e<�����9��1�5�cb�.jA&�!�����ҫ{���:���X13��\��j��.`��)����Gm�Z)�{�`���^yA��^4@��^6��.��Q��r�D�U2�@���'I'L�2����9����>0wnC}(F��E�S3pt"}7�� {{��D���[J�3����>�hϴi�rq�ػh4�:�`�Z� ��n�"D]~���>ض+���[ujM��uK���ԂP�#����#������O%Ѝ�kᒄ{���tp�*���o�����3���h__% /�{���Zh�3���&��`��%V�Ks�U����@�rݹpj+�j�%ZU��h�Q���:c:���7���&&?�6q?2�����D5��[�b����.(�#}h{���)�GXU_� =�[M�5\j&�3�v\������=��9�ַ���.�):[�лr�N�D��4~�l�@$2S_��c�k��tfu3q�G[�co�FZ)�� U���є7��d~C�b~�)!����3_� b"ꡆ;�Q�>n=�L0 �wr�t<�����%�j'�̈��1ͣ�Y� L� V����z�ra��Lo�3]m �lZ��J����?O��ʭU̶^C$#L�|y �HGɵ+�w�]�L�0rdiU1� �S������� ���3�#WQ�i(Z8��/f�b��ຏ���a�[8������K=B�=!�m����M�ޣ�rɠi�v���e�ö�lgѡ���� ?����{/�{�1f|����X+����ڒ���s����T��HO���Ea��!��H�N#ZE�O��l�W��x�h���vƜ�w<��ߥ�ޔ���jƎ-B�:F�s�.�/����%^���6��h�?��@�N�?;�5��d�ᵓ@�}�}�+�1�v?�F�j��U/�p[mK���S׆i�^x�R������Gv�3^(���{�7vt�TLn';̋��4<-s�<��Wvh�V��ɞzq�=��]�w��8�T���`���=� lP4#l�&���̷f���K�ܔ.|�a� �.���RN�6ZW9!*}d�X�ﺔ(F�d�0�5��:���o��}���`?�j(l�z��^U�`�9OGQ=��aťM�f�$WE��J���&�o����B�Ç���� ��⛮�|:}�wi�����|����Y!�����������yҏ��®Nfc���N�_J�g�q$w�ca�7�m\��n�m��˞�* 5v3����c��z��J��MUU7�z#��=���G����]��b�0������:q/��sUclJ�U"����>��K-��)j��������6rpA�A��Pn<> ���HfC���q:ecz�<�DF���$P<����h�^D~Ɋ�Ή�ܐ�yRqz�d��ꎎ��p W���w��p-���իQ�ɟ��ϧk!�d���F"v�6�ְ2��H��n6H-�/~�ia�9�=�֜�b�f�{��qj��[=�͇-oOm !����6N�t,�m�Qv�g�!�0��"CH{��92�W1�j~�LnWfXYt�jPРdl [���y���pF@lXZo$9,Wl��Z�]�����N�-���"u_���� -9��[mi)t�d5���6}��J�j(�88�`��%������T���DzhM���,@�u�w�Ŗ.x ��_W}$R���9E���RHZ K��hO��U ���aq�%*�{�� �n�6�M�u�l��˿{�����P�2�����ـ�(�ǁ^��vZ+���Ƈp4'/�Wm�`���$��3��H�`&��Y4�G�`�}��JR`����R�ħ��2���d�C�{f�{���$�T��Zi������6��(+����).u
Behavioral task
behavioral1
Sample
9e6ee90d625b1a54e9d0966f06285db0b83075ca49ae2debbc7cbd45cedc269c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9e6ee90d625b1a54e9d0966f06285db0b83075ca49ae2debbc7cbd45cedc269c.exe
Resource
win10v2004-20220812-en
General
-
Target
9e6ee90d625b1a54e9d0966f06285db0b83075ca49ae2debbc7cbd45cedc269c
-
Size
100KB
-
MD5
604aa744e8b68ed20efa5e0563430fba
-
SHA1
5a407942e16d792feb5ab5ca1a501f4a1e8d3653
-
SHA256
9e6ee90d625b1a54e9d0966f06285db0b83075ca49ae2debbc7cbd45cedc269c
-
SHA512
2fcaa48703986313af6c822a19e7f525d1f1ea3637b3978c2ce57235ec69af26171b92a6e4ffd7b4b3a88dc79caa08fe2b6ba07ebe86a66f73b53eb7a716b48f
-
SSDEEP
1536:QDShLI0N6PGOFR7O0+Po1VOefA59fycbU6yCXRLqxuYkDc8QEpkU0f:QOBI0uGIi0+Po1YeILpJXRunkA8ZWU
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9e6ee90d625b1a54e9d0966f06285db0b83075ca49ae2debbc7cbd45cedc269c.exe windows x86
8798f902ee6b39e9ef582b3caba9826e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaFreeVar
__vbaLenBstr
__vbaLineInputStr
__vbaStrVarMove
__vbaLateIdCall
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaNameFile
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaExitProc
__vbaVarForInit
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaStrFixstr
__vbaBoolVar
ord520
__vbaFpR8
__vbaBoolVarNull
_CIsin
ord709
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord645
__vbaExitEachVar
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
ord648
__vbaInStr
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarAdd
__vbaLateMemCall
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaUnkVar
__vbaVarCopy
__vbaVarSetObjAddref
__vbaLateMemCallLd
ord617
_CIatan
__vbaStrMove
ord619
__vbaForEachVar
_allmul
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581
user32
MessageBoxW
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE