��cl>A��,{k�^7�#L�/���~���p�H�HsS���>����w��D��t���.�T�������9�fZ����J�ߧÑ�jXRn�����>��h2��ņ \�k �b�\��֪$���5�#Wmv>�*ޣ��V�A�n`���-5�80l[h>(�(*��4��P-�r�9�D�0b� >}Z������"Ѝ�Z���_��/a�#�}���O��e��oT/>U�9�����'�٤�A�X�ؖ�'��S�k����$�g?gs�� �E���+h�9�5�%�Dw���L�c��0<��^�nP|ֱ�DWfDp]]pmM�X� �nx`>��'�d����L6�>RȀ�)���S����M�ޡ]��i�R� au���T=��|� .�����D�%R�,�e�o%�Ӗ�%. ����*N¡O�n$� t�}�j. �&z$����#���M�э�0��P�����`�G��������p]E��$ ��rF���`���Hޮaq��CA�7$Z���Ч�5��Z�@>a����FU+�ݼC�Ne�BYd��X,m\k �`0/��(]�z.3����M�� n%��g���_�ǂ ڟ��ݙ�rYND�Ut�3*a��+�fdyc��rq�|.�Z���B.W�)+�-}3�Z*٨F�o�a����pu����O���y��<r��]�Gc&���ʺ�-S��X9<�����Cپ���N�\�y�Û�K�����O.,�Ӹ/�0����f��o>�\@�x�8ZF�o��o�=�W(|��NvF���l��&w�mak�D���ݞu��a�R�5_APH ��f��rVDʡ7��D椼�ؕ,q/n>?��s�%�����匜���n�꼪~��*��-��#m���[g��-l4�<J�� '+ֈ�������rf�����3�ű�S�+F�C��Ga��e�Hn���wkx�c�:�P`%vG�&��`��w����@T���)�|����K���%Fϣb��C��H�6�@Wݰe(�-��� L������?j�����w Z߁3�b/�|���Rv-��EȤ�TN���![ �蔃ێ����^��l 0)k�N̫:�~ߞLE$�]�Fྌ?�l��� ���Hs��Q���h��(}��g6������7Tk�x��K�&+8X�Փ�=ܖ>[�+&����rz��Gs��?_�Zgv2C�L��'k�Ck�S���2]��zm�A.�/:���9���=�ɕ��*�{i��� ���yO�-�|�s���w���S�MZ���Ng��V������Χ�I<���ژ����^�0~�Ĕz߲�%��uQ�^C��N:��M��u���fu�� �����)8sC�HT��%V��a��뾺x��m���+� V�r�������� ��dy�W�&�����A ��s���z�:nj���,|bփgT��OS��s�c�{I��j�m�3ѻ ��WdT����-�����u��dC�|�˒��1 �ڏH@X��wC[��hN�d�r�QJ��B�)oP��}|Y����8t.͗D�Cx����s�Դ�^�Sț 66v�uF_��Ġ]���9��n6Ϟ�L�;�L�,c���8o�}0Ч�bi2�k>���,}��CU�{�yYN����P*`���SÊ��7�t_��c�YC_O�*o.���%����Ԇ� ��E����~���c��!8��S�`�%��H{�j�}k����� ��l^Y��JU���߈F��j.���ҧ�ϝ�Ƙ�F�R��\�`Ƞ��J��!{ZTr��i�#�#C��i��w�_^���`��Y��?����[T2C�T�����)����u���lƇ䏟\%��0�.%i����u?Z��)b�k��>�c�m�YCu`Ԛ�瑏t���J5��j����x�S���=�?����N�٫4��D�q��d>}=�;�3 rk��ʶ���J��z�_�ܨ�� ��)������;���D�<}�1mZ���5���a2/�x�C� ,�,R���ި*^k��� @R7�*��`��5��:w6��<�v����"t~�zo��t�n��̇����p��[|���������f&%a���� 5�����5xqC��\i�<p��z�~bo�3��3�Tc�4J�Y.A{�s�*���*:x����>O���%kڬN��?�eA�4(�@��m�A�P�%��z�9p|Ҟ�%�4_��&��}'7�]�h�9'���a�s?<������3�������h{,5E�U]B���,�y�A1�2�b�;Yg+�(��Y�Ӕ1��̓���d�Y��-�#�=�u��>�t��4F�?ZS@x��5��� i�E�����XO�{J6�4j ��Hx�g ��~@���u��<��E������9�B��� �)��ц�tǽS�j�1X7��T�}|qt���(`���R1z�yZ���� e��0�U��&�Χ���`�*e�\��3b˿fj��S3Ð�k�e ��wBhV@�7֘"]��k Q�wm��(��AbkW����,�Q]B����������LÏ5=nv\� A���o�~}�-��'���Q��� ސ"χ� nIn��63��D�5��(�8�K�:���:5�>�~����ZD��aJ;��]o/1x�������W��.wK�֓��R�J�[����{;��:xzM�!�K��a ���1�=�� $��a<�Jox�oH��x^��KK��E��S����n��͝�� V����r�猟�;m��ۯ��J:2��gM��F�C�:wX�B`P[2��+����0���N�C�-���{�>r��rώ��C�ܢ�:4I�m������ӱ#�"l�4��M��}G����;��';�!�ф�1}h���j������?�S�̢Gr�t����=��%�|njn��.²W�C�=t#W����'���j8�3�a�d]����E�B憗�u5� {����[�O��)�-Ae�{���R��;9�'ڶ��g�BY��a.<�K
Behavioral task
behavioral1
Sample
b75a5932c399ead8e0bb27141bea197fba21f6563a7d6eabf62e38cab8ff8364.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b75a5932c399ead8e0bb27141bea197fba21f6563a7d6eabf62e38cab8ff8364.exe
Resource
win10v2004-20220812-en
General
-
Target
b75a5932c399ead8e0bb27141bea197fba21f6563a7d6eabf62e38cab8ff8364
-
Size
600KB
-
MD5
04d3cfa5731c5cea392f8fd8c4b0e062
-
SHA1
4aaf351eca529676c9b0bb949b1fdabb89f57102
-
SHA256
b75a5932c399ead8e0bb27141bea197fba21f6563a7d6eabf62e38cab8ff8364
-
SHA512
068da5332af93e07f30e314a2b0daa26266d5c0729c0b6ebab1df54ad72d475f2bd2dc7d7cc0f7ca9228068a0eecc25ba61de347af948979eb5c9f3ad965c455
-
SSDEEP
12288:/Jk8S5n3hDPIRlvYp2fhzICgKYa8SzHWPqKRgl6iAw+q:RSV3RPiv/fhzUd1SzHWi
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
b75a5932c399ead8e0bb27141bea197fba21f6563a7d6eabf62e38cab8ff8364.exe windows x86
0f3dfff763da98c6c9f6cd62c4e8d9f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord517
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaOnError
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
ord309
_CIsin
__vbaErase
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaPutOwner3
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
ord644
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaFpI4
ord617
_CIatan
__vbaAryCopy
__vbaStrMove
ord619
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 499KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 584KB - Virtual size: 581KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ