��O��_KM�(�9�+|cv���!��}� ��Lu>)����h��4xWutR�.�nۆ��*�ƙl ���7B�U��*:?�]�v�t?����m��e�^n�1N��� Yq4�4��y8�\T �F]����䓁����`���s�D#7�^�w����d��&��~�yR��� ��j1�E�4ܠ���T�7N@��B�a������y=�#4�)�a5Ǧ�I*��X~k���g. ��(`���ua��Q:6_�ͨ0d�*������~s�x*�,�[��A�Û��W�����c>�U�Lw�#E3w#�G�"*K8�.��:�<+W�$ޙ Al��zWI�v�Aiɥ�*6�<����\ ���M����|v��k�����5%�bn�'K��ӿ�2u0��p��QB�;Z�<�;<NZ� 8G�������9�'1��DW ��{���K�1/Ǜ~U?����S }U��4�(�B�y<L)���D�~8�4�]KgN�F�uI��벬v;[t�^�Q͘$��!�ڨ���@ߺ�6� �Ӂ�ٖUU�[<�x4n^I�s���Ac�D�3��!��%� ��*���"1?J%�ϘպH� ;Q����n���9Hm�3�8)���9M��R0�YAzWJ:(������Hc)6YIuN]����|fڰ��4��6�}�v�F�zA�k��F����?ET&S:l�y�/���6��jrҗaep_G�KhĬ���7ęI�+�U������!L3)c�D���/&��`�5&�Gv�� ��}�U��o�aE4`Uš���E���?J�����~P`R��%*���;�RP;N�N��h"J��?Ӽ)�o��l%R 6���Z�ܬ�@�8۸�ƿS+��(ФF& ����J!QK�%��\xCr4�U{p����Y-'���^�d_9n`y5��Ja�]�r����-�P�[��I�lnnAk����i?6�d�����"n�D#t��7M��mbR,���DD�x��@���TDkm ���r^#��0F��he.b�� ��o�v�GsedF����#�8h����u|���x�63�;~Ҵ�JA����&b-��6����7�p��> �� ԇ�.����m����iI�,�!^�����X�R�$��vk��w���'bX,n�mc��OW�h�-5qdQ����dʺ�]�xFBaAM��1��9R[��03������������9Y�h���bv #�w�(;��Lѯ��C�uޕd���I�}�.�O���Xt�D�yށt��e�R�P}ƄU/L�gЂ$Hж���# ���Y�W[�핞�a$w�Io�[e�X�TY�"��dN����̱p�oi���/��)��.�8U��b�8y�����L��yX%�$`J�l]��8��w\)������m-�TwU�g�����j�D����?��]>�Y��^�LL�ݓy���}c���2���1\����C1�@2����+E��K�FH��g��'4J�$��-.o�҂%�����m�!�m�}�AP��e���[����Njæ����E�}��-y���w3�<i��a"jWVQQ �L��o<�C��ԗW���H�N*۽L�$����Chߐ �b'r����lj���>;7}�Ò�5fǔ��Q�7/�hP[Y��?V�I�����gº�9��J1#�Ed�W�����$t7M<�^m�1h_�j�Ńm6�A1W�B�m�� ���&���P��fK4�5��|�,�qZ����}]r\�S�6i����5�4�2.�9)[��0ˢ/�����IKbGcE�h��δ�J�Q�c��Ǘa�����A+�y���)G�K�ԫhD�%�2�<�6�J�Gt�k��R��x~ gT��W�>�^���� �����Fxх��κp�MS�[��l랟#��v(�O~oKf��&�+���ړ���ު��=�I@|�ۍt�V����ƑZ1W�AX�}QD��� ���!��kC�K������#��]�/��:�T�<��:kO6,WF��.V�*|{a��y�8y;��B| ��Z�g̛b��\�o������^�����UD��O&���sJ�-sR�ƙ*%%�ت��)��t=�3�2�R����m���=D������:+UAKT�����~�Kж��[���'YMȊXdN���m����i 7@ �ߌ��Ѹo���N9��� U� ��/��/�+�����;����uu��^��;b��9.�M+L'? gt�[6�2ܕb�7��a���/��H�q��X�E�R�i����b<�{��ŷ͊K�����V�Ѯ) �7-T7��a�����[;^� /�b� b�h�'&b��7����]���2�us�B���Jj���BF��DE�'@����3\��bY ,�ͧ� �~dfj �����z�Ɵ�-���~�������9���GK�;_�vQir9|��qEE�§$�?�/���8q�X��;� k��[9�Kx6*�ݝ�$�{0Q\��ս���7���KL����5�L�-$i���pQ��:��n�BkҵM����+`Z*4�{�B����V{o?���F�G��4ލSo!��-TunaԞ�פ��Y�g���`:�Frlw�,\^�b��iF�$v��Hh����m6��0\1=��%�2J���<n-.zI&T[���|wȭUz�⨀uMh��N���d*��c�E�X¼�vN�rp���i���ʀʷַ@���%�uߧ�i��&h���E��a��?�!:�y:l��o� �� � dk�H]�m�T��ѳ�@��>#D7�E[��#�!�ّb�Akt��I�;h�%�*�\�D�������L5�練���"Hu�k���� ��j�9F�To���e(a��'H���^��u���MH�K�ە�3���]�W��n��B�WDrڌ/m%Dot�Y�'��}F[��V�Rz�N� ����d�d�#U�#x��^����a4��E' s%�|6,��&'\%�n�N�d?��Ë#���y�9�b:�f{*�������@C�|���_��z ���� m2؋5��\ A+�� @ga�����8
Behavioral task
behavioral1
Sample
735feb5e2e2c60b888f216f0421e41b3809d2e92eca4dbe740a83b93ef31efc5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
735feb5e2e2c60b888f216f0421e41b3809d2e92eca4dbe740a83b93ef31efc5.exe
Resource
win10v2004-20221111-en
General
-
Target
735feb5e2e2c60b888f216f0421e41b3809d2e92eca4dbe740a83b93ef31efc5
-
Size
5.3MB
-
MD5
a55907fad6046fd16b7ba501362eec68
-
SHA1
b546bb79314c0406b9e8d802e3d6083a4ddc3ac8
-
SHA256
735feb5e2e2c60b888f216f0421e41b3809d2e92eca4dbe740a83b93ef31efc5
-
SHA512
fa703f2a566c32870a70bbce585d4039fafed8690e6749bf241da61fd432fb8fbe13adc6b7404a95b8e52d082eddd6684f5aaf7175433699accfc6f324fef485
-
SSDEEP
98304:opvXYmEi5SPT/xec9h+pG6KrzwlKlOdXl87xfKfCsJkKtWn0Z:oJXYmT5aYc9aGhw4l+V8tfKf5JkK0i
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
735feb5e2e2c60b888f216f0421e41b3809d2e92eca4dbe740a83b93ef31efc5.exe windows x86
9a88eb18e85713c4b4e389aeb14c2438
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SizeofResource
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
vcruntime140
__current_exception
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ