�9����*u �X��lVX������:�?���,��ڇm5���L�K���+P�p�G���& ��(u�6[�$]�i�i$����}d�c~:R^�Ȍ�d*#H�Y����x)�*�$��aj�fw��K�eS[�`��L�w|җ�x�$�m�ci\H�������)ؿ����5r謥���?����-�cO��W�K��6.f'%��!�.!�~�U�6U���=��\������@�U�vbPp�q{�X������Z �t��>^k�uI7"��97�D<vaI�n�o�� ��.�d��^�k<�t#��e+���kzTS䤔!�z�9f$�RmX� C�{���o������o��_&=�� ���h��Q�:0����5��T�h��C��妧8�(�Z;XGG��GC2�����j�Fj�Pzb����E&�c_��Q]���=TW��SA���?� �F��*^��SC�F��4ǝ{y�8h�hfx���">2���E�4��bq4R�j����D6�Fx@A7t�[Gߧ�kv0�̑S}�d��l/3]���{�;_g�֒C��� ��mq-��ӌ��$����P)��H~�)|�Pǹ��U�4��1sz���DQ�i7��#�f0q�xjY���7+�N<ηk* �^�x��A��(��R�ʡ�� *��m?�%�:qJp��';dFg��c��!�̾qv���$ehi�@x0QU+��Z���C^�~�m�� [u�Cn�~~�������������g�7�1�j�pyC%뿳�"p��8��x�TQ/��T��BPCB%����~��\��}�U� 1_J�)��Yl���wޗ��h�Y�&E���<T�^g��nbd>\ӵu�4�1�Ⱥ��Q��R�7z�ҍ{oZ��м���߲�����Ѐ�(4��g�'�b��s���%lЖO� KRyx�jѲ�"#�Q��٨���^\��d�-i���}5�mߡSt����=��� 3�*�a��Ѣp�uH>2ŪߠUl+����rۿ�.��Z#j �2uy+ި��"�@�?�W�M��Q��-N# Sڴsg�*>�q_v�}';CL��I�ʉCe+��X7�%g�,"�} K�_�^�� ��$��8�=-��/��;^������Y)Ɖ�#a�jL^����2dߑ�ə����5�%��-��d(�TvQ=����zLr9��*7Bt�p46�<�rZ"~�MȲ�㕲�����ֻ��������F��U�Jj_.ci�[t�BV��ʡ�\���g�-A��WzK>�fN����Qpn��O��3��;�O����) �U�] oYoP���{$N������f�n�/��R{��P�J5*@�N�w�sM����Á���c�/w�Dž�&�Y�B]��3�D�o+��U�;��l���{���3�NC lֽw��ۮ�-nS>L��6ι]W���y�a~��c��-=�Ҡ�u1�i%���!̔��;*��I�5(��E<�(�) $#�خe&<|RȔ[ST���+���H�_�c�l�?����,�P������ۺo@�dϹC���~�խ�����D>]ˈ��"���Y��� N�V����[çƿ����,��.�.���KNUX�&��fjj��G��I���KVI�m���dv�DƇ��>����p'C�@(4&��-�ؓjx.K��� D0Bߤ\smV<��?�,�"h�SB�`Twϩ8&����On\�T$et�[p��f�5s��-_�Zk0<��g�Ш�݈�=�@�e����Luk����0dO05o�l2���yO�<�@�T-�����I����2kꅵe?��"��ސ�FIG�+�(W����?�3�ey�)�f�[�S�%�f�"=�s.O�T�h�����&u���ו��7J���:�5�(���½" f�����Aj�X _�����U���1 ��B�g�&�V8�r�}�W��'�� $K���sgj-��7�0�Q4Q��#K�����Y���F�%OuX��u�2�]�ݟ���\�k��5 pP�~W�VL�_k5KQo� W��6;������ݚ(g�(���;o�F�!��@�h%�[o�Xr����R�j�VC ua��A��zƀN���W3YL~E����Ұ��j���Z{#����b���=L�5�����s|�p�JIy�D1̿}]�.����=�%���k�Ό�{�&5�P�����}w��I6���h�3a�2*@��������5�E�����MA-Y>m��rJ�7DM� P�@�h�Y�����a�y��]���ނ������TW�;l0dr����i����D�^��앶15�kq��~�U�g^Q��=9N�;i�4��L�{I�����x�/G%\�[�qL��Dƛ��ueO0wK��}������̍���I���I4�y���O����>t�� 8�G_�����}��a'ޜ.:�Ǎ���4�T���:��p�>c`� hr���l����V@Lao�ǒ%�?`(�������#%`+'���ہ��,("'��<RϘ�f� Sx9��FgP�j�JnE�1�S���:r�ˤ��t؍�5j���R��1��f�J�/N���y���u��0t�A��_Rz�XM�r2��]�F����{�#=��1m_���zV>�9��IV^�^���h���#�Ǯ�_t+WaLD�L7��=��?���P�?��˔���N���DUp߽�s�(tG�����'��&�����!���1*��q@q�0�T.f �3�Q���a[�����u��7��E�I.9uu��8W���u�%�)�Hŧ��> �8�A��m��5�с��ݖ�m���+�h�����p�<?���[>X�q���U�d2��>�2�p�"O�5ΏǙ���X��ji��YlA2?�����<�'H��\u���S���i_NE9aLX �N���}�@��@>;d�����Rœ�>N��8�_�w= �����۟�.Y+!�;/�;�̻9]ju&�r�`�ΡmDd4.d��2�KI<s�M�Q\�[ �{F�����è��� �<�wHA��h
Behavioral task
behavioral1
Sample
d0c0f0e672589c6fa0bdf7cc75db8fd68cde51402d3d5cfe8f5c663cfd9d2994.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d0c0f0e672589c6fa0bdf7cc75db8fd68cde51402d3d5cfe8f5c663cfd9d2994.exe
Resource
win10v2004-20221111-en
General
-
Target
d0c0f0e672589c6fa0bdf7cc75db8fd68cde51402d3d5cfe8f5c663cfd9d2994
-
Size
100KB
-
MD5
9c2eeca143a2f1c4c494b87b5f8444a3
-
SHA1
b788927bacb7233bd08ca2197cb1599eea611b0c
-
SHA256
d0c0f0e672589c6fa0bdf7cc75db8fd68cde51402d3d5cfe8f5c663cfd9d2994
-
SHA512
8ff505852956baee725603a20ade590349ebcfcffb5a64d4488f82f2926878b2edff19cb3e8fe7446facfe355f2821a28e241b3fe28c2072591526126bf68d8f
-
SSDEEP
1536:F+WGD04y0M5uBV+flKRtnihUeyRMRykar14M2QI558Dw4xGf5ua:aDW0MSI93aMRyvryMlGf7
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
d0c0f0e672589c6fa0bdf7cc75db8fd68cde51402d3d5cfe8f5c663cfd9d2994.exe windows x86
404c22b44d62566128c013d33b801428
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
user32
wsprintfA
MessageBoxA
advapi32
LookupPrivilegeValueA
shell32
ShellExecuteA
msvcrt
__set_app_type
mfc42
ord540
msvcp60
??0_Winit@std@@QAE@XZ
shlwapi
StrCmpNIA
psapi
EnumProcessModules
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ