@���PS n����͠]?�e���Cp������r$�e�5�.��<<շ��,M��iD5X� ��)�֥�,��SI�t�䫮�u7^�XLb��h;����H�&��WCSh��l�q���m A����mm����5[�.6N�L� �%ϷT��<+<�(23#���"8����тb��R"�3kT\*���L�~o��п��p������c����hm(B�j?���X_`ޟ9v��^e�/�o�Ӵx�k�<c����7�TH�4�$_����:Y�����m��c���� ��օ%�ܦd�ov�y�:��r�X3�XV���J#�A'n p�sL!�dM�Ȧ�϶O8R{��Ũ%�3����.�Ws�(�q]LP����e$)�fz�$ʐ�`�E��H.�Z��R ��K��.��ңH�'�;T���MT�� �V�w^�pS1�/<�<�Ck���R@�J*v���S�0G%��O�� ^����Ӊ���� �4��P�шP�9y������[Y��p�N}���P3�1��t����2���1ȑ�����xE�V�� �� K����P�@п�j��� ��ف���5=^���:E��@3�K�B���S�qo4&W�,>H����'(�s�dն�I ��ͪ����A���P|�����8��5%���7�Z�D��'�����rLP�=V�l���ݐ�n;x�{�%.�ixÉ{���ҩ:��B��Rɲd���sy`�;P��,���C��kv�/9�l:��;9ͺ�2�g�Z�:4@!�������4�\��V�������q���$.���1��������쐲���0\�i�xV��s^\l|k��d�ds�!No!FHE�*���_�&���|�#p�r���#��p��ɽx��L���11��\��{C*��Aj��S�W#�͚�s�k�����p���x���bl0��^�0$P��''���ON�2yX�9�{�Z-k��0�A�Úl�p3Y�;d�ڜ��0�ޚ �X���9����~(,���N��y�K�w�D���KŬ��ֶӧ;�?�A�(vDž S�T�d���ItBr���n�e�.*��*����0����/v�f������2Ϳ���xČx��������F(-E^��$�.�|�NO:��a���<p�!�.����:����Q��<9^�l��WJ���:ŝ"ڑ��e$�%'; ���D�����3���[�����M����4�pk����ژMI${1�oxH$au�I�W��!�9����������GU�Խ���z� 'A�`�7�X�9)���nm8�~B����2�L���V��<�p��+�|f��T�O�ೌS�DU��D�P҆��짔*��K� �����2H�yg�6 r1̗䫌��ɮ��[��R�(�žgD�`p � C.���N�g��ϱw�e9�/�2���b�[���m,�'إ����>��N��Y��H��qo���B��m����)"�A���dn@���9�_��»5jɁ�=�Z�m~��]˫S��}�^�����/��+�DXP�k�F҈�5����f�"8Ȝw3��+1 ����!}��-��VM�}��!�gU'�;iW�z�� ���.J=%.�"C����^�d��N�(��:����ѱ����s����=W�L?�C���3vQ���!��~Ѕ��1Mm��sk� ����.��<4�R��d��*�a�w�qʌ'wzF��s5�+�\i�I�����}(��7�ME{�?����h!�9g]a�R��U�y{X��Kw��s�4���4@���h��ltȽc�eRb���D �(lOr��FU�M�Z��������j.Qp�n�F`t�2��J���Ԅ|���Z'y97���I�斖6���[�ܑ{2>1�e� ��C�70.ʻM�u�%����5tQ�@Xdb��m{�AP3䞿�4m������0�R}�3��˱����r@�X9NP5T��B�u��1���{}�Z��Su� Y�e�Q��A ��I���S�gC!��o� �#(�[0[o�Z P���r�|���}w�3$�I���Κ�A��/^3nC�0%,o 2uέ.2 kRJ>��n������d�Zma/�-:"��n��������>�C�d�(u[�P�3H��%#� $���zϴ�>8�c�����G��8��+.n�F�CW���$�4%��� B:&=�t���(c^���żS}�.7�s��� q�ƶnb8� ۀ}�}� ��tn�`�'��-�`�v���w�����!�^�T�����$2�<�Ȯ�.���2��!��b�MY*�Ѩ@2"�1Y?f*23��G=��:�uD+�Mp�=�:̋��7�B���N�-�,��`�����6���-2�R�9?w�$�`�BѪ���a1\����ތ .Ts�PWRQ]�1���A�����B�k!n�0�$$�%q@�|+)��B��<��{x��:PT�����'����D{�������/vE�O�@�{��II<���r�҆��Q���*\G�+�'�:�QPz2D6'Σt����i����rxm�Z3��'��R.d�H�G�C�3S-�(��Ք���q�h����_��m���o��e���Ǎ������L;�U�o˪�Ċ@+�u��o�b�Z]�����t��=����B,�{���Fbs8��#� (&$�o%�/R�X��d{JC��S�v����'�zV��'$Q�HG#�#�!�*��5�Ġ��,f��T�N�������1���yumt�T�������,qZ0���LR;����8V#^-X��A��/�h�� ��� ��� �9��F(�k��7��9���W�"HAHu��\>���R@�x�F+�#�|���:�.Teh�} ��f ^|���E Vp_� P�,N�5Ǡ�i��>Lj��d�� -x.���D���E�`�s��Tʅ��C)��<jhNj�a�B+�\w5DZ)�*�Y��"�r!���!�7���S�I��j$�r����z>��ml_��*�0��<݆���v�$�أL���,���\�X�"���B�
Behavioral task
behavioral1
Sample
ede707e9acef3cc2de7e9a6e3ab2b869064ddf69c4a510e1510a250004dfd76b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ede707e9acef3cc2de7e9a6e3ab2b869064ddf69c4a510e1510a250004dfd76b.exe
Resource
win10v2004-20220812-en
General
-
Target
ede707e9acef3cc2de7e9a6e3ab2b869064ddf69c4a510e1510a250004dfd76b
-
Size
156KB
-
MD5
3f17f63a227b16630e2396fef16144be
-
SHA1
204a376e352ca4e698dd366ecb261efa347db3be
-
SHA256
ede707e9acef3cc2de7e9a6e3ab2b869064ddf69c4a510e1510a250004dfd76b
-
SHA512
d99a47398dd640a85d42fd3f832798a0654a7bb6357bc1a85977936f62838fe750ae1d1fc2dc20d0b9362393a35084203a6a0ee2645d4a8ace2920845d1a9fbc
-
SSDEEP
3072:ebZQ7MmKd2DvUrJQArxjnoxDAnGbasa0m5QwNoOnGjWuD:eb6HI2DvyZFjnoVAn0i5QwNoOG
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ede707e9acef3cc2de7e9a6e3ab2b869064ddf69c4a510e1510a250004dfd76b.exe windows x86
0f3dfff763da98c6c9f6cd62c4e8d9f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord517
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaOnError
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
ord309
_CIsin
__vbaErase
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaPutOwner3
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
ord644
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaFpI4
ord617
_CIatan
__vbaAryCopy
__vbaStrMove
ord619
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 140KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ