��|&&E�è�#�2� o��3-"�&��z�t�A�)/��a�$L��oU�̭t�NM�DM��"�����.��-45�c.N͜��4π�-�H�b]~������*:J���7�!|ʉ��¼�!Ң�����-E�_M��q�J����l,�5(a���*�ݖRT�'��tYZq�&x���ʉ���f(�����)������W�:�s��'j�� ��8�;��B���q�#�d�[��"=�s30D��ݮ^� ͞(.�.�l���Ff>���}yet�#)\,@�Ȱ��;e56Z��gb|�� �a����1a���S��J��?�~*��Pi�g��N�xk�>������ t�s<������b^�����G����< ���=U�P��ǎ_6�����Lv �7���O��'iR� mo-��S��o4��@(�~X�7&s~i �`�������w��>�-���5����*� �I�:lbO� ����s@�yS<�$����M��@�ː�=k��S�~���}!�z��A�I���������#F��D�va^I��`�s�Y�ێщ��9�?�ݎ�폚#�����"Ki�:�q��V����q:�Ƕ���23F��z����#�ߟxCyK�B����9ט����hKm�>��ԁ�=�@���uߗ��)����vg�铉�e�d�&�8�:F����_�� ���1�����b^��i3�!��|���uXa�4a�����`����e2n�d�w�|�fK���L���F��ٲ����q����F z��q�W�e&�8*��2z���!����01 !1�éӢ�d�`%$g�K�~X���m�!�ac_�:w�U�Q�d"t 6g���F���g]���uI�+���G�I�=L�8Ɉ�;S�����~?����,�_\y��P��ߊ7���+O�ʶϚ��\P�ܩ��&��9Ӕn�ד;�"�Ϥ⯄�j�mq��%��bL]YG�L��{���Lt����Sa��u���+ C�����l~�����"��1Wt�n�I$0&9��^�4Q%+>�#^` ��z�i3��X�O�v���]�.��)"w�o�'AM���YۍE;9���I�(����p!�jC�J �C�bK���0X��a�1���o���K�D[�����/�4-���&\g�@f}�8l��B��6KG��J˽���xg��g��K@�>x�s:�p�nO�z��K2�hk¯g��� �=�dR�OM�����8b�����y0�r�(��� Vɦ�~��cIc}���F,�A|M���x.�n�d���� �O&n�"��Nz)Ը{��ACpcےpu�#?����#��W�ۑ�J|����)��|�8�Y>ޕLV��Ȉ���ג@����>��ڭj�z��.~m=�q1&�z`�+�x��*��r��wIR,�ʱ��İW��2�ؗ3#�Z~��꣪��%=����C�ƓZ]�=�)=�\>pz���*J� ���b)��Ņ� %p�i�g���+�o�|zKb�DK�]�\����vfS�9&���7/�(� � �"kI�D8%��C���gm:�.ՆV.@�o^�` ��,nz�F�J�Nc������cl�� �RHz����� �a�O^�eml8��x/�|rtB�m��M�J��J�;�E���4s�$fH$Y���ѝ� ��|���-��\56��LŤ���dXts���#K@��b<",[F�-����ts��=^����Oj��L��F���WS�����2�˅^DE#]U�����w/�!W��I*,��@�A"P���/��t틎̃Ʃ�`fŝ�A�D�sk���h����0�_kL�{e��+�O:�1�W���ў���H��� H�Ư� ���Lާ�C}��p9���Ȅr��71:*��L�~r]�� yXۄ�yY$�tSM������� �u|��2!gy��q�un�,1�jv�\�"���@��"�u�q���0R�����?�����_�b�m"Fp˟^[b$�Y�Sx��+!Dk!_���2������u�*�m��j�C~����~\���zm7�K ��-d��L��ؕV��b��(�+���u_-�)NĎ� �pa�Nk�!�-��n�{�-�U�|`X�e!/OC���(��0]�MN�Z#���|R���X&���K�ZXx]�bɐ ��ϮXq��O�d�!�����$ƀ'WJ���1�� e�[WrD������\�#��������]�g����T4���U��\�t�������U��~PK�L��I�2o��Fݝ����%0M}a.4�e4�Z!���k${o;}�����һ,� ����<������oc��Y4�~�] ˡ��v��!�^����֤�k"�a>��,�;��\lA�^�t�zN^�B�O;�:����-f�3��+z���F��A�<�4��F��Q���H��^�j[��#�!t�K�� � j���g�1����x��g��__r�Jq5�Q��{ψ��H����c�� ��Q5� �Px�a�ZP�S�C����K�)���gA ��������>Ѱ�<�Ŵ�������Qx��s���Rcb��&���wLɦ�CY?�ynTa$�R9�����S":#��)�ݫi����32�kTy-W��2��v�̑��pf��#A �K�Q��AG�K���*�Mֽ����s+�g1�e��^;��t_S=[�B����������A�g� ����Tu �9S[���������g(l>pq@Ֆ�eH%d��r�`˔���8�L�贡�����Rx�hF6)�%Rz!W�!�j+�@]D# 4��W7�j�DЭ�ݿ�H�� "��n����g�Ecr�FM����߭�=sXS��vF�#���� �7?�)gݠ��h�ؔ8$s{�|�(ʦ�g��N$����]����2����w�t@8z���]��"�8�.��m�S�(����?�ޚ,��Η��� �6z� ȟ5PA`eev�X�+Z]�&�aL�!9hE��3t ��VH�-����R�������30��E?8FD�� ��qD/*a�9�:l
Behavioral task
behavioral1
Sample
c1897f1175c1baf788e99793faeb8d4486b069766d6401b1ff5a7829b865479b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c1897f1175c1baf788e99793faeb8d4486b069766d6401b1ff5a7829b865479b.exe
Resource
win10v2004-20220901-en
General
-
Target
c1897f1175c1baf788e99793faeb8d4486b069766d6401b1ff5a7829b865479b
-
Size
620KB
-
MD5
ce2fd3a463aeab6341dbf44e4e5f8b16
-
SHA1
ed4b440b71b0edcb37d1670f23a03b11f1268f4f
-
SHA256
c1897f1175c1baf788e99793faeb8d4486b069766d6401b1ff5a7829b865479b
-
SHA512
ff42daf0cb59450d43ba3adc2025f449712b957aeceb841c5a53d977c6eb1a03bdc5e95bf008ab55893a1faa25c99716bdc7e3e40a7f6686ca6d063846080e3e
-
SSDEEP
12288:V0lXJfzXba9r+1uVEbIHmw+MrnCKf2QRuRTn+wUeh36E:VQ1zXu9rMRYmUndX+n+wUeh
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
c1897f1175c1baf788e99793faeb8d4486b069766d6401b1ff5a7829b865479b.exe windows x86
6ee716adb55f3607eae01a4f13844922
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
LockFile
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
MessageBoxA
gdi32
GetDIBits
winmm
waveOutUnprepareHeader
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
VariantClear
comctl32
ImageList_GetImageCount
ws2_32
WSAAsyncSelect
wininet
HttpQueryInfoA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 450KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 163KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 504KB - Virtual size: 503KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ