��#��2���!FEޡ�Q��p�����p?����*G&�d)$�{��KcŮ���A"f�ޞT����j���Km�9T��_$�ۙ��_f���Pג�r���<c�+4ó���d �Iҋ�JG�� ^�\�G�5�e�5F+|�vvz�u*�A��+���+Y���s��Н��a�b��B�P!�eO8������#���@z�^�a�4�^�e���?�gΐ�0{���a��*z$:/�"�����p;���!}�'b�A�̡�Q��]����I��w8�$��vvދ�#>z�:��ѧowOrZM �\����Ҿ�R���%ϖ�>U�l�%C���*����M�BVހC��*�F1�~�� V�G���L�<��Tsj�4������ |�e�pc�d�5������U�+���0�<o*��/6�-���̨����L������ 4�^[�h�B}�dɱS�?f� ; ��?�ˏx7?��V�;S������ֿ����6�qx��}C�`�M�6&@�?��C>�u�Y���RB+�)��S����m^@TJiM���p�;bۆ�!���棪M����UdC?%��'�<��C�)�� ]� (���j�qI�p�5~���؇`�d�3>���kl�k�0M���`�e�֞;�o�<켎���}�}��#��ܦ��R� ���v�岌W���=u�1���TP�7��av 7��z`}g��0���APZݕ�U�+���(��r���e�8Rs��R4K����rՠ �\�u��|<�3k�K������[,���n4�Ь���_���`F���35�ƃ �"��|�x|�2f_<�`��}�*b�̷Jd� ����e�dW��TG�#V4�hf���V���;����s�O�x^�'�p���ǑȔ_ed{�����R6��7����j�tAA��VH�!2�����4��S�p�� �(���{^�7������ݏ�n�3�^eTX�`�lz�A��Q� n����*y����������<q���w�1Y/���d��PUL0ƶ%s���0�G�i5Ӧ'��r��$`P��t���~8P#�L`y�Z�� 1k��1��3�7rÔ�����,^LI_�:�_5�sxф5'��AFU�B�ČA�+?���,#���K_�&��q�{5g�ݺi� �j�qӯ�gf����iƚe��XX=�?����{/��犡��B�R�����m<D&Hf��1�颋ぬ8J���� �n!�oL��� �6_�(�Z$F�R��z���g\s�ظ��{.�LGk;5kQ2��[���1�t�X'����:��%@��ؠ��Rj�I�����FGHm/&���.���V���!��R�k8�oi� ����œz߳l����$YM.�?;��_�w�ubgx�}�L���^�2�W��oN`y�@��v��ꓥ��H%��<�&f���v�7G��w�&�b�8��͗PFMWTH��3͟c��^6�3�=��BZ��$�GtgT���Z���ne��s0p|���~,�/���,�����L�2�6��'�hEE��,j\_M�J͟:\���C�4��e���-p ���3��.KS]� 澍�E}-4k�.�_�|!{.���X����8;�b��\��w�?J�'8�d��'���`�R�\��BEn�vgt�Z�{A�lX�u�Gӽ��&Z�m�y��jK���7�+���o+#�"=B����N�=�ހ�07�1#�|� E�� �3N�_B:D���M]�q������t���c�l=V!{-���T+$��:[��'4����e���3�������sCh�#Oҭ�.~�����r��d�S�UC��C���uP�"���g�uSm�М<�9G��Υ7(UH�Sج��L�w���dT�Շ0��V�<�C�y������wxĵo�m�$ޱ������5��:PIW?S� E�`C�J�yS4⼡NO���m�"+���:��gįj�e�7�"��ї��F�uH�̧}�V��*}Q��e*� ��C= &~����~�D�j}�_YZ/�B��f�)^��X��^b�"a�� Эc�*��#��v"���P����A��w������$�`�Ы��eQ���Rbq'� �.���I#/PT��J��r�����<��ooy�/��}��3��^Yz=������qI4�N��^��i9�{�k�&!dv���g�;�PY�n�T���1��ÑQ�����[������5H����z�r$�w i���ӿY�y?�k�T�z����m ]��Ib���i<���*{�k��U( ���-��q����y����Et�^�� �d$�y�.ƟD�t�Ճ�2"8/h?��Ҋb�IUZ��LI��L"]����h|��JGt��A O�ƁL\ _��n�o�6A�B�IZdnF���ʭ�3��՛�滹K�Y U1#��ĬQǍ9��*��}u4 \sws�R'FA"v����H�\;)j�|*��Ղ銎 <~i���'Y�i�_R�$��_7��}�ن1Z$"ʆ�h˺���#��7"�ԓ���3}����^n�O/��c����VK8m�������6�������K�Y���?�W.� ��k��ɜ$l�a��[�҄=j"��,M�X�;I@��r�w�V�,� Y�DZ��]"��>[�-���j`���hO7���=(��%����+�0�<9��!i��*�u9`�F�h̥�W3�Ě�b"�d�7#ɖHcaΪ��j�� ���u,|�%��]�-"�;-U$��|�p�sj�fe��?>�ىe�����~����"�4D#+l�ʖ���љ��� ����'_U`*���8rݴ���2�x�b{�42�I��L��v��q��=y��Jy�����'/� ^�3>��6'�0(�~�e�'��3��l�vz�����eP� ��.,��*D������"0OP�H�,�ٹ�D�.1�5�ͩ�[o\�5� ?����Kt;)%�����t]�d���Y�T�g�h�B�(����Q2G�l����I���+U�~���'��P�vȻ�v�â'��e�� ��M՛�kS��Z��
Behavioral task
behavioral1
Sample
972b18fa933dd8a0eb7a3c73d76e53ef90b4d1943c7ab8d59972785a72707703.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
972b18fa933dd8a0eb7a3c73d76e53ef90b4d1943c7ab8d59972785a72707703.exe
Resource
win10v2004-20221111-en
General
-
Target
972b18fa933dd8a0eb7a3c73d76e53ef90b4d1943c7ab8d59972785a72707703
-
Size
120KB
-
MD5
65fa098cf64ba5f4ce8515c896000104
-
SHA1
436242fd0862146795f07f6a33ad1a6bb3788cac
-
SHA256
972b18fa933dd8a0eb7a3c73d76e53ef90b4d1943c7ab8d59972785a72707703
-
SHA512
7c16ec5fcaa9fab6ec06a3baf920c952bfca7ed735ef6968edc54a809c071c2a95722f5b5e7b473c47e3967db69def1ce44bfe2ef1225d76407a0aecdc200bc1
-
SSDEEP
1536:HDOlMiKd0XpQzrwUP/oeCU/ZCFvv6oHuq41SgyO7Kxnvk7ei+EiE19Vs8:HqlMiKd6pDuzCU/mvDYvRKxnM+zE1
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
972b18fa933dd8a0eb7a3c73d76e53ef90b4d1943c7ab8d59972785a72707703.exe windows x86
93dd00fcde078d13ae62f250d84c53c1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
??1type_info@@UAE@XZ
comctl32
InitCommonControlsEx
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 100KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ