�Y&�v�.�L? ����z�vϢ�ץ#韉�Z�w��٣ּx��Kh6�of%�b�4�%����3\u�<�Yz�@��0���ke'&��c� ۔~N�x��T[]N���.���<�W]l�'L}E)F��y��/���J��r��ǼyW�y����7��&��RFS�P�.dO����m}�{��:_�_��$v.�\��jl��gN,㳍zId�J��NM�7��o��3XN&���Ô2ʷE�Jl�)�h���|ɖ�������x��G��ִp"b�NU1�na�:��,�54�z��^:�gi���s'j�BSoփK��U3;*>Ҋ�i�6I��I��^1(�^O$7�\ސ�d��7�EO��Bh��5i{�o�!��E~$$��v�8����/O�e%�����˄T���Y���@jL�u�N������D�Gt�������Ā� ������"Dc�]��� .�V�=����E��S�h�^}�BG�{���Fqf�G��W��M��4��<k5O �$.X�A @xV C��Y�<3;p~gj����IZ!�Jw+l�,⏁Q���l�4�@�rN�].��������.L�b���f-���h)���P4Wčm�X�Ӑ-�׆4 Δ�Q�?�M"�B�B�JJ�zP\�q0��� K�[�W� &+�]�z@e=�����IkWX�G�Cu/��-B�ƾq�����݊��L�� ���L=������y�o�e.��d N���jҊW1�"|r�����������6J�8��"�cԏR�盧H.�9f��"Xw�]��OU>c��w�Ŝ� z[�+�D�J��~��l�%��G�/i���8w�%�H��/j� hԻ'вb�$�P������)rd�������@��(R �؉,�21�f�[�1=ɝӾ�G�a ��Ί�����.�u��$�=�b�۲&f�c��1���ɩ�"O��m��T������W @('�����V5�n@J�*@C��Er�|#t*V��~�jԁ{��He��%i���z5`��1�JE��C`3�,�-���1X��4���:a�"<Z7J���#u�6k�y���.-*�� ,֖Q�=��z[g ��WV}a(��+L��E�YD5Xղ�E7z����M�O�E�<��'Ȳ'K����wIe�i���&�������I�F[�m`ʄ��r�)ai���z)��Vi��^���ŴO�ڮq���Lׂ?s���c��̸� IQ������q���/p> ,���_2�%�` =�7��G3UKim �_3k(S��%2�>�a�H��Y$6�5�����D��}{ ���؛������@�(�Bzָ��2y��)���s�Ho��0i��p�9�B���OC~O��ڥF ��������� Ȭr���u�t0^�,?�LhF71hP�֮���Z>h���?r�FA�Y��1��R���UT'�@5�����7�S4���?e���=�G�`o�ЖW�"!!H1���Ld�b�ZFg��41��W�8�l3���� 0��]f�p]� �8%#���>-��a+����`���Dd�] 6����'���i.#V��}���� "!-E��r�����FŃ���OgpS$C2G�w`�H�Ĭ�[kKC$�\9T���7�YՋP��&�ݻj���� ��qH�R�����4�ή�q� <�o���Q)�����MD���R&��`� I����*oUw�`F���nH��F�BaPRO9�C��V?1��8]j�����B=�i�Q �9bܭtU�J�з����`�t���qQ�%��/�K����n���Xu"��z�5�����Kܯ&�){Y`s ��JnԦ�wlg�y��t0�(u�����y�1���q�? RZ٫����&gdevR}=f0��ܖ.����J�)75w�:[bG�5�LQ,�8�߮���-���+ܒ��,V�,�B�Rd���w��$�¾��9�?����=��Lj�^��E$73�`J�Ȱ����G�"���/v4*)u:��}��!��9ِ�;xg��;�?�U����E�#�5Ҙc��X��_�Fѧ���u�����[Y��1�@��� �� �(���p�����R��_f'��v�}a��is5R�SA��1L��B��1�H�� ���ގ�gF����y��pϲ� eG���k��`�x�HT���y�˜X� ns�uN�������F��g�y6�"���!Ʈ�}�|�s��Xڣ����Q��SR�H���'p�e<�����̐���+}�ެn��e���3�]0�fN(r'���q�y�|����tF��n:t\��{�碢��r�6U�^Աl,X��J/��#�Vu�����'�8��#O &Ea �~��|D� ڱk��]X�H{��o=à�kK���mֳ���\�E@i�{�H�������dlE� ��4zC�f�U|#@LX&����D~��4�� ���v��&�B�T�敬�����0Л�1��đ���ϫe!��bA��M�?�GExkD��������s: ���}�W9QÒ�;�4���@��j̲>g(A6��-�"s�j��j��T��J!��?(?X�g0��_V}����<0ȭ�$d쥭�V8P)�Mh���9����En�� �p�l��-$��IɶH��ʷ�+G��V�E��Zi������Y�G�5�p5��@0t2�(��Vm�5E�>e�8���l; �����6lfw�Rw�Kv�<�:���CGۖ�i�� �]eS��� i� O��v鑄g���R�qp�vh�6��N�3�;��ȟ��oF�;ލQҕ3��}���=� qm�`����*0ZXkXy����z1�I�(ĝ��w F��%��rsp�^2���f����mH�ō�jc�X�b��7��8��N�EOs,�(�'t�� ԉ��i��)�ރ`�?�(��:��RD����Υ�b���������p�P�h0�1 \�b�/ZW���(�M�?�ݓ��x\����h8� ��,t�Yg_���E��`(�P�`l�I�M�e~�ˬ�h9�]�/��2%֎E�MElG ���}۵25F
Behavioral task
behavioral1
Sample
f1f07c17ff534bbecdbf586192b860961f6ad6b574508d248b1f628a21ba2a4f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f1f07c17ff534bbecdbf586192b860961f6ad6b574508d248b1f628a21ba2a4f.exe
Resource
win10v2004-20220812-en
General
-
Target
f1f07c17ff534bbecdbf586192b860961f6ad6b574508d248b1f628a21ba2a4f
-
Size
120KB
-
MD5
ae2bd2123df99f72f35fe4e8b81ec603
-
SHA1
8dd54b0a3c5bcd1332e6dad163f0944c68074bcd
-
SHA256
f1f07c17ff534bbecdbf586192b860961f6ad6b574508d248b1f628a21ba2a4f
-
SHA512
b61356059bd04a039f7e870378cf55cebdbb48104d68d83598f9793d7e1eea2b1914ad9692d6008248762d17e6346959c77c3ec5824c121b814bb39c49340b98
-
SSDEEP
1536:CDO/MAE2gqz890WUxOLZV1pkAV2xUaGO+i8Ov/lnQLeXk0AuVu9HY3xBweJZM:Cq/MAEg89xEUX5aGOz88BQLqk0s4hN
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
f1f07c17ff534bbecdbf586192b860961f6ad6b574508d248b1f628a21ba2a4f.exe windows x86
c84da386a07dd11a2cab562a5844f88e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateSemaphoreA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
??1type_info@@UAE@XZ
comctl32
InitCommonControlsEx
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ