QH���Z��ζӎj+������Y(S�"�d�O��p��-��t8���yM�z������_�(�&VVuJ�ŏ��a��H�<�#l�E��>���V.��q3a�Q�!���a��i�;�8N�ȳ}�Y����/~��j�(���eG�I��*K�C��f<F�k�w�7������ثOWu���m;���e�R�:��B�S���&����� X�p>�r��,�_b{����Ĉ��O��[�Vږ3o�]�>i�ɷ%�윤��J|����ǀ��n��J38�_�|)y��5n�=�B�i�'v 0�'��e�MG&���o��@�+j��Q�|��s|�l<�蘏�O4[��0�S�v����}Ġ�|�y%�����9�3},&��ZT����9�.tC^i�vAh)U�}���Q��W{V:�=n"eѬ���W~+N�Yak�R&N3i�_���)�t�hcgp��r���L���QɃ�ͷ��.���(S�� 0)wD�L+9��D��J��K�xVg;���m�Aj2�)��^����w�6#�3R����u(������Cr�܊���B����N"-N���ͅ3cH��}i.���W�Ƴ�v�%��!TH�d��|de$d �:D�2��Iٕ��W���f�[��r�p�M����c ������l��:��X���C���s�V��_}�yʮ3��n�� �s���7�=&O���������˛<#-��i������@f�j����p�q��l��e� �k��+�CW�K��҇���`��ɚ卒�32��SY��=�:�[���\���m��&u`.�K�E����B�-�?�=���(���w*ki�'ȅgq�pWѵ����][ĵ���X/�����`A��,X�s���җU��s�A!3� x�d��XH=J�Cbi��7�_������<�c�� ��u�.-����8M������4���"����0*A]r��at4�n��+�q�ȾNlZ4���#:3��g�;t0б�"��/3�ba�pPn!����2�8��M:E�\%v Nq�/�i���?�i���=��Fn�%�<�N��]�.�JS_(H���{��@�������m�uC���'To��p�l��x���`�V�Kr���4eZ�d����vG�=H4iH!sDF��Y������c�����~�.�|�E˩�b��u��pwC�)V�ZZ��7>�4��KX%��ӆ���9��>��=���7$}���k"Ȫ���t��ﭝ�=�S瘀 ��C���z�f�_���P���9V�Rg/�<4���l �l��FG֞h���Q������f����4�N[��I�����3Ԗ.9L�,��H5�y�j���>DQ�a�����BZΦ� "� ��e��sb��!�g���H�s�n+�'���a�Y��\Lf�R���(P»q6L������M��m�mk��+�x�S��d�{id���EB�DO���0)7*#�p9v`�M`>sQah��}#oG��n�n��PG�G8!f�R�3����#��*@���^(������|S��%*���%J��e/,X[��~"�>' H"��c��%���Y� �"�jX�a���M�ŕ���iO�4��P�H^��xLnztp�j�J�2��*���5b: ����xd����t�zD^���! ��wG�a��L�����*���������D��)�*%����[�'}�����@w0Կ�W�6a j*�����b�'>����z�A[g��X�����C��ϧm��|��r6�k% u��� lu�65�>�Q�.�5|H�N�w�~�����lr �u��_w��p��`+X"x�[,�c�/y� �M%�J��>��तV�V��wg��D��ʼnI0H��J� �6�CU�Ҭokp�}߄�.z�ei��|��2I�yp��`�K����ߵ����F�z��ߊ�H�AƵ頒v���5"*'��ma�ekos���& ����@�����:�%�W���ZS�Bp ��]��3�3L�`��<�m�I�G�<A�����`�� �;Bj2M����C����#�5��;v�� |*��\_��D�mbQ�0�҇�l�k�]�ǖh������嵗�����M��A�\գ�Ƙ��P���tZO���e�sj,LM�l��21 �ar���0y�E�ӣ�D���u��ϩ� P�1���,��ܹ���o�+�+ky��nbg俴�Y�������<�b�TN��V�G�:Nj��=�*���ԟ[>���ŀ�iCt2�*����>�c�hе����#�h���-|3}�uΉն��T�ߎ�5ӵ��\���s�J�.m@��*v�|��0�q����2��WKVd�@,"�2��Qv������� C�� 2�Ж9rZ��&j��&*X���;�zO��� Н���V>wB��q��#7L�lFn��l�s,.��9k"c(�tEq���0v6�w�^L��DdSUY �����|�NR_I��O��V�j�n����=X�h*���.��N��I=�{%;�+,��2�09I�A��K=���L�{� �M�A���L�e��y�� ո ���Z���aU/���Syq�C��㧊�G�u[:���l#�?���&��m�ut}͉�cr_z6l��s��(:Z�f�)g���o��7�5����X�5�VwR�w�9��gb�������8`1��~pC>��q WF�'2K�@�ىP ]Vk�;%� SF����|��x6��g�^��<�Z�H��-�vލ(���n��閃?1�v���%:-��<2|��d7�WZ(��W�|��d�6,t6����o����e�~u1�2����T�I�'l�B�X ~6$��L��r��h�pS���j�_��1 2v��?���-�Ћ��Y,�tyxt ��P7 �o��'�r\-�BG#���;�C��Θ)�?⭍唄�7ڶ[q��z;�f�)�=� jदL�s�!��z{��c�*�TP3�f!㊓�)�c%�����ፂU5��G)�w�4��L&Ơ�D,��u�����g�����P�!��\8~7����k
Behavioral task
behavioral1
Sample
921ee15e73bd81f069f6bf7b7a2fa364db6d1c30d7bb8197fa3c4cf6a3a7d1c9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
921ee15e73bd81f069f6bf7b7a2fa364db6d1c30d7bb8197fa3c4cf6a3a7d1c9.exe
Resource
win10v2004-20221111-en
General
-
Target
921ee15e73bd81f069f6bf7b7a2fa364db6d1c30d7bb8197fa3c4cf6a3a7d1c9
-
Size
499KB
-
MD5
739f7554a3f0715ba8f1ec8f552c1a85
-
SHA1
6f99537b2227f8046a79526a6e46a991f2782368
-
SHA256
921ee15e73bd81f069f6bf7b7a2fa364db6d1c30d7bb8197fa3c4cf6a3a7d1c9
-
SHA512
212072f8d49b32892f244b68932aa079e4e593e9b8ecf47c47d0f24c364d80418aab614ac97df6931eba6f2052505fc6887b2375f28fe64cfffb77f39f96a7b6
-
SSDEEP
6144:5w6KJUuF9+CexlRGY+4Fx1O1aR+IJWwJELXypWS8irQE6Y6xYhlK+cEMm+A9RpDX:C5Jx9+JLRIuWrXc8it6lYmFqd3D2Zus
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
921ee15e73bd81f069f6bf7b7a2fa364db6d1c30d7bb8197fa3c4cf6a3a7d1c9.exe windows x86
df5e8f74117235ea96ad96e7c26017a8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.nsp0 Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp1 Size: 349KB - Virtual size: 352KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp2 Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ