��]�����C:,��u�ֻ����j1p��Ի̮��*���Un���?�X�����>� ��������Uv���P���^h�^ �}��|tձ�����$7���ɺ��H�\��u̧v��{]F��?d�8}�?CW���L��Q�J�i3��'J���J'[�-�<�f�~���i����A �=(�{B=���A.S1Y?51���.����#��UM���1X����~��ǺA�Q}�J��׆Щ)���d}�+nL�ǜ�!.fl;\���3z��&�>�TZb0[��͐�|��(�/�p�}[��53?쁆��9�6��Խ���P|��FvA��V4$NJ]~7Ύ�+t��q�tIn�^��t�J��!<_.�?v� �����M���=�5c q~�nވ<gw�H-{�����ДB�l-�s���I��xVCC-h��?�hu����e��v5��u W{�� Z���m�*����g��r�H�(<���s�}.����.6;�SZ��/\A��a���NM��۷u���m�W���B��z3��: 3��������;����{���1���Lʼn��E'�7 �`95�rM�&�i%%~���hh�5�n�Ǖ=&�af��S��)>������`���ЦIXtR�S,]^=f-�!�S)�K��GpV](�%�f#!�پaݨ���Ӂ����;���O�����/K�GV� P|ή~��<��2�ߞk;| ɜ4\0��<O^K�*���L��I �Bƚ�w�(���������{lF��B�o�BrM��5ꚣJ4�t?�a{����߱���)8��qy����F�!X��g�@�9DY:��'��ژ���E(�<����(���!R�x~f��n����DO�d:Y]�,|r4 �%2Y���p� ��S��>�h?9V���ơ����C���A���4\/E-��U�3cN�f�}W5��N9�0�T�z(�-��Us���G��pj#�pH K���1!�Ƕ:�� �^�ڏ��Al�2M7�и��V��N�գ)Ϯ���=�����z����8a8G�h^�������]j���Cya�nE�=���B���6��N'��{w%1x�PiY�F��v��Q�o�Ɖ,�:�����<X(��.�]G�g�{ F�DȣoB^�u����E�6��� 17��cAT�{`](O��t�H�̙��@������kG����a�Mn�����_J�Z�w�i�D�mn�${�'/y�jZ�p�Kr�H-x�7������� x�b���I|0Y wa�R��oʦa���CV>���_�nO)��������8^v�ke�+S�]:�.U|7�MVX4�N jz���p���{�����4����Z[s+Z�V��6X�D�@�$���멍9Xx6v���b�j���P!�T[d��5�M���邹�o���l�tWv �� ����Kn��^�(�Ɉ����&�ړ�8����xHq���X^��+Dn���Fu�w��]kS� &պ����'�}z���-d�[o�щ ��]��\י��c�&�2�h���<��ڟ���a��L��/&&ob����VӱN��$!��E(`?v|F�|+k���r�� [�A�US{�ZϘD<���v��4#�#�ٶ��z�b_G��o�%�xe����̷�!+���uj���_��tM_��x�&S�����`��D4����l�d��6��Џ�6(>�l�|!u�J����tUg�>��c�0�{�U�Ĺ����e�^��le`M�{l��,���}f���y�$��gUY�86��w���~��Ȯ��К:��ʌ�P}V�"��J�6��v{H�l̈́��H�[�w�TZ� �QScG.�YѪ�0�`%���w[ex;�_h^�|�������vɕ����a�ڭL����*}PW�y̬��u�ځjn��{�[�}"}n|^q�������������r�&�P�}�s2iwo�U'��2���U�:�q�qb�3�x������O����C�/����OӚ���Ʃ�4 �c4��T���ͼP$皟wVyS�&�m!]��E[�#b��l��t�;�D�D��:r����: �8�47g�ʂ�z9G� 2o�/S���(l��vbk�_)�#Ugd)��j�tI�F����x��0`rM6r_���)۷ER���#��;�F6Ն��'��X�whjX���/ˀ�1n-����Yc�ܠx���I�m�m1xQ��"X��=���������i��1F�q���h����&]Cv���#@*���m��X�����+g[���ȋYU������T3�* �(фɒ���^�A�0^�da1Շ_� ������>/�r��{3�}1�w�������yVB�{�BF�8I����� �T��a:]d�?�s-Q�#�ˡ��_V��ё�V?8���#V &O�h/M?��g)��p��b������G�gKl��ZƴΉ�EE�RLE.9P���Z�G�L��|�����(�M� !���D����o*�a���adÀ�|��Kb2j �����.��-;6�|��5x֍ �����'>�%��W)#�_�G��̷��g�[����ī���P�yzS�ӄ���������dž?���|��Z.+���Z�.���\�r4�xwB�*��t?Ps���<@y��+����v��2�3��\�z��QV ��@6�P��&�B������8î5��Cid"j.#�p��_4�':�=��,�שH��EK*r�RMX�K��>�������QQ���*��B����>o���B|}��q��������4�ĥR-+�֧��ʗH<�#�1L��Ȓ���`�q�&@��7~V�����m��;��u|��P����/���S<�R��bu.n悻����l�FE��""�k,��R)�t�V�|�#VS��ӲH�wv�7�yήlAZz� U�Eюx��K�n��Gau�yL����6S�e�?��U�N/�)�.�Eִ,�<y�;�ѻ�1��~huiLٛ�H��۸-?���8��Ƀ��4��!���{
Behavioral task
behavioral1
Sample
f376d149871be8dae5d967c8716893ae64a7a8060e5d13eef8f9e569ff114828.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f376d149871be8dae5d967c8716893ae64a7a8060e5d13eef8f9e569ff114828.exe
Resource
win10v2004-20220812-en
General
-
Target
f376d149871be8dae5d967c8716893ae64a7a8060e5d13eef8f9e569ff114828
-
Size
72KB
-
MD5
78ef1efb806e42c1752c859244463e65
-
SHA1
d8f07f2cce00155f2d9711207eccef18f5b041ba
-
SHA256
f376d149871be8dae5d967c8716893ae64a7a8060e5d13eef8f9e569ff114828
-
SHA512
fba268f1f0f63205525a3e899072bbcdb05e872eccd04ef18d641cb1a4997dd5994208368a57f4fb56cba29279ff89317a6719eb7732f5fa564aae3c15668d16
-
SSDEEP
1536:/F7pmaIFGVZy3wurXGde/555My5mew+MyE:nmaoG/Ru7GAxvMmmew+k
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
f376d149871be8dae5d967c8716893ae64a7a8060e5d13eef8f9e569ff114828.exe windows x86
955c8b3311d67dfeb955d1752279ba3c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WinExec
GetShortPathNameA
GetModuleFileNameA
CopyFileA
GetSystemDirectoryA
LoadLibraryA
GetCurrentThreadId
GetModuleHandleA
GetCommandLineA
GetProcAddress
ExitProcess
GetTempPathA
DeleteFileA
GetCurrentProcess
GlobalMemoryStatus
GetComputerNameA
lstrlenA
CreateProcessA
WaitForSingleObject
TerminateProcess
CreateThread
CreateFileA
WriteFile
CloseHandle
GetVersionExA
lstrcpyA
GetLastError
GetTickCount
Sleep
ExitThread
lstrcatA
GetCurrentDirectoryA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
wsprintfA
ExitWindowsEx
GetMessageA
PostThreadMessageA
GetInputState
MessageBoxA
advapi32
CloseServiceHandle
OpenSCManagerA
OpenServiceA
DeleteService
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
StartServiceA
CreateServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
msvcrt
strstr
strrchr
exit
_stricmp
__CxxFrameHandler
_onexit
?terminate@@YAXXZ
_exit
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_strnicmp
_controlfp
sprintf
time
srand
rand
printf
strchr
strncat
_except_handler3
__dllonexit
mfc42
ord800
ord561
ord815
ord1575
ord540
msvcp60
??1_Winit@std@@QAE@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
ws2_32
WSAStartup
inet_addr
htons
gethostbyname
gethostname
sendto
WSACleanup
WSASocketA
socket
connect
send
inet_ntoa
htonl
closesocket
recv
WSAGetLastError
setsockopt
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 245KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ