]и-��JQ�$6�!��d�\�������B}�(Y֔#}���Ng���V7�`!#�`w��I���R���z���ve-+,KƋ����P�u�،�V�����w?v{�1�ӗ��yHe��[� �������BQe�"�/�M��Q����|OiĚZ���o�r���hχ9������H��z���d��S�<���� c�_�X�0M�������β\��C���M1����\|��4Id�hcBo�F���p�eO�&&�gv�lq1N�BT���$�կ�Hp���VPfΤ�"�a���u�̡Y�{�[�P�:�x�ES9����U�`d�'��v�O��a��p�qF���Dxq����n��qD�(C�f��v�����qXj�H*.�X���A����۱���`R P!�{^��Z��O6�������&�>������@.�>:���հ�'�3�'��骯�2�X�P��;a��Rs�r�|�z$�@ˠl5��K��W��^b��e���o�D��iڑ]U8~ݴn"��N��s� �;��� �+P��2�v�iԃ�Kx�r��JX���>ᦫ��� �W�~:�פ�sE�b����������1�0���K�D����.3�F������@�4lV,��6�+��G�O�W�o�05�,_�FP�a��Z��ⰴ��ay�\���k�#FD����o�q�Q���r\{��'�p*�Y�n���ͦ4���8��ɉ�o¦�c��Z=0GE�01��%m�I�Ż�(�\�������d��K�0�d���w"�x����TT��|ܼ���� ����.��ff㊽ȹ��v��_ئ@jb�� jK�ϖ�QI���|oz�k����J���w&���x� [ՙ����$x�zl>��>��:�.�!�N�,�N�L��.e*qoi���41B������MM��O��I����ɯ�R�F?)�z0��u^پ�-���7�'4]A}Ʈ:OEe�@ކM J�/6��\ۀ j�fxYE����k�}�W� ��ݧ� L ���Y�7���w-;*��QS1H������ۼ._Wj�[<9�KJu��c�~�S��b- ��������7���߭=�N�5���~�>����(@�R>�n��S�\���r��}G0oi�����<���8k���]� �Z-(����;=�qȖ�= ؾ�$p���\����iU��&dU�cSi�EƤ�]g8<Tq��D�cZU9?P��b����{"̫J����(����Ԟl�P�=���'Z�h��g���Ot1k��5�,�{]ԗ��m&؞D��P���t6m��uïBމ��e��FƋ)sDZ��NGk9�WӪ���"3�)!��q.�H��� ��������c�H��4�p� �T8�'�� Lr �yb(st�j�)!8|$MMCS ��5����$��QY�P���/x�52���T��D���M{�ĵ]a����̑M3��s��Ǜ9.��'=��Nw�Ф���B��+�]=O��((7bA�Ӯa�&z�:Y*Y���}s6B�6�.�y�e�3������ % ���r�tЋ|�S]f� �,�� ����]�~�c�(wdh�_%4 9/�cS9�y��aP��nG��/< �è�7�q*�Y��X`� &�Ńx!�G��2at�ݫ�'Q�L�~Ң"<��Y�l.����ͱ� �Q���P-�|��E��Ss4���6Hu;s��7ҁ���Qk拮"'R��k��V��*��Ak��%�}��ve|p݇g��N����ѨTy�)DW7D,:�A��� }7c"B���� 1��6ig�L������w��L7R<�c��(eшy��7�;�(��;�V-���Ą93��ء�V�h2>C�gy$���x�f����?Cb����3��AXcߙ��^Aȇ��C��~� �a���#w��K7|��Q5��&�qt�H����ڬuIM,( �H|�5e�9�RT4쟛C��)�����W�7d��蠁 ���'ohdǟc�ȅ}�g�$;�d͔B��D�L�RЂDO>k�˜�g�>�,�7�̽�����|I �i���A�D�#�s��-�^����N��K�dw�O�O|��{>l��%m�"�I�Z��� �����t�� �9��}�Ժ����|):|�[C[eSݹ��g�B�<��9N˩沕����RQZ�oU4�����tE;��m��X�x*�Dz+�7a� w5��鉎5?D����C$��O4/���7s���r�K8�t�ܞ���T��"���z���`�Az!k�7f��H�3u�:�l ��� �U���Y����w�����-�e��A���.�=*�!�Dž�3M�����O�Tڗ��ߐFnF�Om5�tތ��>�r�m�ɿ2Ғyxص8��}�����I��_**�4������/�!��K��~z� 9��N�vj����Y�4����Q=�H����?9ݖ~۟9�.���TgI�Yeg)#��A��*�MtLm��w��ieT��g����?��<��-�qT|O�N�PA`�1n�2����,A�|` )�7�4M�8��.#��t`!osʇ�Aut&�аI�a��qAܥ<��;n,��Yff,�fi����}M��^ӂ�o�w���o+��'�����:��Vu_�9�o#�qF��X���:�uvX�Yg�w��np(��AGK�d���X�7N�nN�U���ƆQ����<���t 7&�kV������J� ��MϬ���M����nlGIG��n�i�U�� �{<|����5�.V��*�^X�����c��x**�\�~ ��c[*�'���4H�1D5=��e�'-�ه `�cEZ�At�ѣ&OȻ�Fu⏡ZnwUq���肊b����9�o*[az�pL����N��5x����vm������o%����-"��Q�Y���c��PUXECp����b���[pA{���$?�=�����#���X�b�k�f�7FXp�fo��Y��Fq�yjG��̕k�X�^q@o�K&3� �١�_ ��07�fL�MIF!�Z ����!F������n���p}
Behavioral task
behavioral1
Sample
4186771351e8caca05e65e3e1ef6988b02ad8deb4eacd62d9406e4d55371b979.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4186771351e8caca05e65e3e1ef6988b02ad8deb4eacd62d9406e4d55371b979.exe
Resource
win10v2004-20220812-en
General
-
Target
4186771351e8caca05e65e3e1ef6988b02ad8deb4eacd62d9406e4d55371b979
-
Size
1.2MB
-
MD5
b33984f885cd98f5f1a0364dd8bc253a
-
SHA1
48e20e66cd68636bb33aa4cd0c91dba944d71cf1
-
SHA256
4186771351e8caca05e65e3e1ef6988b02ad8deb4eacd62d9406e4d55371b979
-
SHA512
fdb711c0d4099ba94a4de121e87679c4e29c472b04eb0f376bc00615bf1cb2dab18f6784b07b107e912a5b8c9a5e4d5f50b5ea774d7cc8e263eaff95b19841e1
-
SSDEEP
24576:QB/IWCp2+d+G5/hKUCpQCoziUPZrOFKzEfuakkTqe4cZCccjyEY+m:TWa2+dlRhwozBGCEfl0cHyY
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
4186771351e8caca05e65e3e1ef6988b02ad8deb4eacd62d9406e4d55371b979.exe windows x86
2ddb009550e35f64119e5ea486abdc0a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
winmm
waveOutGetNumDevs
ws2_32
WSAAsyncSelect
kernel32
FreeEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetNextDlgTabItem
gdi32
GetTextMetricsA
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
SHGetSpecialFolderPathA
ole32
CoTaskMemFree
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Read
oledlg
ord8
wininet
InternetReadFile
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 638KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 841KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ