��©���Y�>r�xhi����>uu;�\Gb���$���{�4�EǼߟ5ﴳbJ������akzP�`W��'���"�M�Gz��5��䢆[ @�*�x-{K?��7Mn�0N�����C�2��f����)ګ�5%��+��QR���<�K"��N���z��Y�R+ �Bp5� :�.�����mc�Deo���/6u߱_�7���xc /L ا�� ���:����Fo��vB�P��h:4�v�O��L [��$����cn����!������8K�NCE�����Z��!�ȑ�0Q��z��0&����*��CȚ����m����|t���9����P2�m�����nUr���of*ť�F�X?V�!� ���,����^@��� ��F(�_��X=���ѷ��% zf��M܂|�QW5�H�in��� �C�V�-6W|������i� ��Wt`��(m���\ee�l葄Q�� ����} ��˟��+�O� ٴ|Xb�J4,*�KA���H��s @*ޑKS���w��$�����k�T=�ff� T�9q�� ��!Ð�o@�y��m����b����6 Y�w=K�/2����`��Z!�U�$���^��i�����#U��.�����GBa�� p+�S�f[����n�����bG�O��l���(�2j�Иel��"~��J�td���3٩q}@�z�wp���*Z��־���m�q$� ������B+�K���HA��C02;}fl�jw���pX�e>�"?"j�!���6��>��n��̍��\�T��y�l��?i��J�0ٶ����K�L��[�^h ?vQq���]뤄%i���_� �$p_x�m��%^��]�Szv��E2B}�B�7�;�����5��N}�i��dc�s*�`VD$��b>��]�`�ɾ�a�Ҭ��_�� �zw���gVͲs-�R����V�͏E��t�lJL��,*���(�71��t�x#�����hdy>�2��lS唰9H*ư�؝�H���L[��L8�j�<={�$:rhK��s��R�ڐM��b4~f��B�;N���e4�Z�d!?sh>�ػa�y��n�~]�! #�����&��Xlh�����5���4�o���%�dZ#x��p(}a�ghp����Y�{�Į����,��ǖ{�����CO��cʟ �6ɵ��G��� �)�������>U�ƣ(s8����ۆ�+�ӂ��2������د�/&`��C�|e���9(p��M�,9w���챀AZ1h��_Wjљ��/�#����� 9����0�R˚�8DRC%���]3;=�+�>�{ē��Q�w�d����6��F�6 w\L氍�}�\�8����r�����Ԥ�f�ꈴ���R�((�f�:��د�h�p �B�H�%�:Sg�|���lr [^>��x���k���>� ����)!�r�cϫ��0Y=�Y7�9r9{hZVg��: $�V��}�9���Kܗ��6�lƷª=Z�$�e����tOe��&��9���-�"�I���kw��b���� �����\��!z4��S̱���t�R�%by�������AQ7~:�I5�.��@���6��q �A&���L�L� L��m � F|��^%��=d\%Y��`��s@��.��]�tf"�� �r�{�f�?n.����|Q-+�˭M)s���EU��F5�U`;�Lڦ��G�� ��D�:�9�nɛ��Q��{l"K7�����.��JƳcC��G&��v�����3�٩p��/����j%u�S���rE�p��(L�;i�����y1�G���\��|�Ijnͣ���Ƒ�Y�h� ��+LY��|R���7�Q������VS�̼� "U�J������>cC����6���^7�|�3�A��d87?���/��v1�ߧxI�p�]�1<��v�]d �ho�u���E֗�gXY�<o��:"�u���fEԷv�3ȳ~oĤ��-���Jq�J��Z�H�#���Ao<[E��K���/9� D�_^�C��?��:3��x�Tf�1��������_|��R�KjY �|E"bu�������i;V��������Y0��1UX�Ze})� �WZ�D8���tq���H�N1�xƼ���|ɾ�4��`���։ؑ�Q���y�fJ�ҙZI]��[�d 5 /�P/���9=�uk��z��X}�k��<�$< �QQJ,���ٰ9�2�{2|zڐp�0B�^(��{�cג��ľv(��Am��T�+&N2���/y�vc�N��3�������߫����cú��!��0��&V#!�c�1�� iጉUʪ�!:���#*(��m��|7rtAE�blŽy1(N��F�$ֲ �t(d�����p��������%C�O���[��@�C�\<3��/CȆ��m�h�x�8`!1+ �L���Pa:��n�"������n$��:we�S�/�h������?���sC�36r�x�����r����g�i�A(����5i�v�;��ﶏH�d�~��/�M�;�U����ʩ`�"��ܭ������_��1o$~R��zt<ã��ǜbNb��#���&���ԣ�h�����;ɞ\��3�@��R4:,��h��o?�N���L���7��Ϛ��xQ�u���z\����)�+�Ū�]$q���� �����pc�4��1�^٘�>�ɀ.�"����v����(i:-�N��O�Q;Ab�)*�]��k��^?�-�U��Y*����v�6���-�~�^ml<�Џ�I�-�B�@�֕7��x#��%$g�m����k,��1�:h<D>~�����P5y2]��-�q�������^y��5.Ey�מh�F��b ��&d(�џɠӲ��]��h�5_�h����t�R�#i�A��=��T���EM�L2��[_�� \\�NǠ�T�1�Q!��͕��jNd� B)�O�a��m�.:@(kS�b��E �I�M�� <���!���[�OPv�TK�=�1����
Behavioral task
behavioral1
Sample
69665bccde56d674342a484f3e1b94e41472856953affdcc3dea5851173714bc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
69665bccde56d674342a484f3e1b94e41472856953affdcc3dea5851173714bc.exe
Resource
win10v2004-20220812-en
General
-
Target
69665bccde56d674342a484f3e1b94e41472856953affdcc3dea5851173714bc
-
Size
88KB
-
MD5
27edc2d6a0f9d1ff9f3d62f8886a9a18
-
SHA1
6ea03d4fe1078e64be38bf1adab07aeb66079365
-
SHA256
69665bccde56d674342a484f3e1b94e41472856953affdcc3dea5851173714bc
-
SHA512
79e03dbb1502c572ec5448056064b72e09ebbab6aa1564e893c933f89948fd24a8716d88ee091f14cbd415eae16c5ba3dd13ebea03068454faed254ea4e1540b
-
SSDEEP
1536:RDCRcILbjmNDb+P4GMRNCaTWZXcyCbD+dJG3PL4r5PbEOcaO1ESiP8T5b3:RWRXDm9+PSCZXcySDGG3D4rVFJOtb3
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
69665bccde56d674342a484f3e1b94e41472856953affdcc3dea5851173714bc.exe windows x86
4e1f9c837a4ce7a9981d59cb0f398296
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaLineInputStr
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaExitProc
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaStrFixstr
__vbaBoolVar
ord520
__vbaBoolVarNull
_CIsin
ord709
__vbaVarZero
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
ord648
__vbaInStr
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaVarDup
__vbaStrToAnsi
__vbaVarLateMemCallLd
__vbaUnkVar
__vbaVarCopy
__vbaVarSetObjAddref
__vbaLateMemCallLd
ord617
_CIatan
__vbaStrMove
__vbaForEachVar
_allmul
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
user32
MessageBoxW
kernel32
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 76KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE