Sq� ��\Z������,O��SL�[��S����aJQlG���?���+�{��e�S�'��'g�]{�C��,¤�7����� Lx�Z ��$x���h2'e�4o������X`����w�����q�����F��H/2�� �λFO�F���Y�`�j@)O�%[�Dd��$�ұ� d�9�"uu�B�IE�N�,������"J�T �z)D�Ó3N�O���D�}+�U$by�v ��i�ĩz:�ח�,VZ� ��c�g��$s�9a�xb��v3�M���l$�F�#�;������2��`Od ��O�>���b��N��tZ��Z�Vw,�ոC@ ������Z�E��a�����b|���3�/ V��#�% ��~��AVdA)��]�lL����0lBb2�0EJ�;�1P���&G������h��h��VB%��[v�+ 0�jx±�GX+>CM���^��������@���?e)S.cd�xWX�w�{�G|O�"<�C7�K���*�=�ub��}v}���"X��]����7u�H����UU�g��_P%��l�㧑 +���ax�\y�`���@*m:h�C��e\�[�k�1v<ҿ�tO� ��� <��H��`�R�&��Q�Ce !:�c�>���r���v���/d�(�����^�����h�B%a�G�H�� ��̃��C��әTKv|ŮBCxl��c��ʯy��I��+t�D�g�]EGC]'o#縠[���G���9�Fz&�r����7�t yA1�/�� ��ɗ�:)Z�Z!�7̻�+���R��M4�,�����d����)Wu�à5�����ܻ�J�:�Wݦ����7�p� g�?����+a���>MF&����e�%�$wM����O�Qx<Zp��I���tA{{���o�`��HK�*�����ѠO1T���ϭ�_�c;�j>��/���F���B���^ZnÏ�j#�OE�k�P��(�ĴOf��W��!��t ��2�Z�l�8[Y���, ���~@=��i����7�P^�jǍ�����_?��4c�,���t� ٠e�3��JH�o�ءf�}k���"�����d�[=��i�C,��$����>yMZe�!���]Xn�x�����WᛐS9�u��R���rx�db/��`NG��rb�] W;���5� �������� s=}$�^&i� �tb/�?WΦt್% ��p��D`� ���k�� :�_!G�p�zL�q�S_)�,�j6"&���E����Uk�V� 6�0s��V��'����]\�U�F��������sNe�W�rR��J���Ù{Ʃ�� ���a-$�QD�D��%�+hx��2���6XO���� ���|�돺������z���_�� ����=�|g,�^ȩ��m�jM�F����g7���[��{u�A�6j���C!��X��94��g�v�[��X��rD,Ed���>������@����{�!�j�ѺW��Z,�#��������G_���GV��]A"�)���ą��mCq�#4?X�^���2<�S�R�#x���v��n��P�I�x�¼Yٺ5#����z����3�N��Ep����}�d�o���=����� )�e�� k>J9���Ӓ�������%������]q����}no�U�5�Õew��~F�([&��f�tf���S@�Sz(���m��,�J�p7T���Qu���h!UX��5��fum���e���~,C�e�8J�E������l�:�Z��?��>#�7w�u<��gd����u�+#f�"ЀH�G3ˌﺡ� so�_����rHwa̎F ��q�?b�(c��� �x����FB��V7�w��-��/5bFf����?O��#� M5'Z����#R������=^:�vp( ���3y���E >Y�^�>_�#��� ��;mx�*��Cy@�z���N��A�v!�x��jAd��F���ۆ&��q���ț�;S��Q����OP:��$��z�6�` �dj1b$:Ե�^@|��ȓ1��u\� Е$����Y��C�?d��~%�Ƴ�����gԳ�)Tt1?(_A�F�>���~�JY���BNb�6j��@�26x��Ȃ�|_�{q1�n�!Ύ&_��p��sF��*;:]@���z?X��V�����;�DO����F���|�_rx�p�3ː�>���s�[hs��E�>�Ud���E:�� Q9q�T�����!/�5l���yV3KF�������� �Cw�¨X LM��$?8v���Z��l�� ǽ��X�C�/�D?O��ތ9�3���z�%��^r�Vۏ�A�`�}&��a�% sx[Ҭ�u��}ϴi-V � Wp4�G:�;�;��_, 4"��*����7����l��I𱄫T9\����l���$�I�ެi��2v���BXJQ>��V{4b�5��`���_�A��Vn� ���q��X��k@O�G����ȝ�P;[�MÍ�*�M��N`�r����"�E���'�i�Y����su���,��Oc��Iɕg3J�\��\-Z���(Ю� �b~*.��������v��Ur�)�&[��� �u�p6 ��<��D����g����|b|ƌ��0�[ i�0�Ay2��&Eo��: �S1X�RC��LB�"�Y!t����eJ/�e��1���%@s3�Xwc�W�7Ѻ�e �)S�����CE���y��L��ۊ:� t�so�'e���_�� (G*>����j�`ճ����2R�i�GZ������b!�B)���AEĊ:�@���7롍�/�y�uFz�`V ���^*cV���'{���u��)h�3Im�z& ~j;([?��W!���M�˧kw��s=b ��R��ꖁv��>���3Ǵ�!JJl�V0A�@�_�(Eoz��� m�w���n��a�/���R�S#l ����������~�@�I"�{�(¹Otlo^�n�<x*�c��Dt��Tn�U�Eh0�6��j����!���r��3#�����<�<���9�\n�_�@�k�$)2,
Behavioral task
behavioral1
Sample
db45e1cf6f964662e4d8363439d3ac41a7fc4825b97e91098e8c3794029e5e5e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
db45e1cf6f964662e4d8363439d3ac41a7fc4825b97e91098e8c3794029e5e5e.exe
Resource
win10v2004-20221111-en
General
-
Target
db45e1cf6f964662e4d8363439d3ac41a7fc4825b97e91098e8c3794029e5e5e
-
Size
490KB
-
MD5
072b6a71e069c9ad5d1bd5f8717bb730
-
SHA1
89bea29711b8385ead8ac0c8842b9ec621fe2867
-
SHA256
db45e1cf6f964662e4d8363439d3ac41a7fc4825b97e91098e8c3794029e5e5e
-
SHA512
98d6f46f6fb772ed99fdd01e5e4759edd3511c31a3e4903bf9437a716257a8767da0ab2d62dc54601a2cca3bc897a874e95aa5d4cffafe4e7c1120edcea3b204
-
SSDEEP
12288:bHoPUHVsDyE+AgHWX3JsFnlRaDP7I/uo2wjgbumi8:bIPU1vAfZOnl8MuZwjgLT
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
db45e1cf6f964662e4d8363439d3ac41a7fc4825b97e91098e8c3794029e5e5e.exe windows x86
d72a6eeae3550fb0af3f38237946a581
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
LoadLibraryA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegQueryValueExA
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 485KB - Virtual size: 485KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE