JX�ʷ�e�̣=HZ�}"Os��h~�����.UY� �3n`��xЯ��kc�w���)q���ޟq�:%���J|�1L���W�z�B�l ��ȍ��0��p������6�c�����|�5�����bL���+��\��b�͈����� ��oH#���&)���� .%��Mϲo�$6�i�e�������Y����nZ�a��GB.="����A��;�n�E� f�Au� O� ��v���[�ي�4���BS��H9r0�ȟ!��u*ń~����3�>z&�{�8*�������7cb��,9q��W��^���C�?�DD�4��2ʠ��ʖ 3E.+�n~k4�W��q}=1d�O��jf}~&�`au������Y�N����G҃8X��\�X�0v�GC�ٕ@K!�evӡ����:��\�����&/D�w�_Y)<~v�>��k?�#m��$y5({=_ġr'd|J�oeذ��������}W)\n@�#� ��=�\xn���W-��1�B��W4t�P�&��OE�&{R��5�9���c[0�(��XG�<= U��iGo����*(l�X�{�lX���p�s����#��U���]�x� 4�O�l�0�e� �Q���0sJ���͜Z�w�tN��X��]?�r��`����=�~��Ր��֊UD�O��-�|�v�'$+�h��Ŵs"ʴ�B����N�ԂП�����B�&En������fְ�Ypߩ�g���<�+�������u'9�K*0��P�k�b~���0�f��@ʽ�������hj�%�B�[��d� �<95T� F��.a�]�.����B�|�@ȵ�.m��9F���8��$����`* �x9���Y��u�o>y��`����҉�3�PmqV��(�oxC��^Bj�������&-�(����0��t���8������Ȳ��Tv��-��p�{�Ar}�履X�;���Є;HSib�+�u���b\�nZV������������矿D!J�ߞN�u*¸�P$�.�'��THe��X�ʕI�^�+{AL7�"����=�@W��i�낎�aAG+l@����{�� ���y��H=�f]����<H���Sף��A����n;,n�����1@2�(�n����V^�w�c��Ҿ N,��2mP�^��,o0=`i�a�7����p�`˕��Ys�71�B��o�����P鶩4 mnc���TLHpV<���] JΣ ����)xB�[*�^�X=J)�h���U&U�3%��Vp�Z��.���xzsγ/b��1H��'�i�dQ J��y@��#<8��x�E�tBjU�C,A&S_Z�����|���i:��%�^El��{���O���\��\�a.���n$~�{�(�_�Yp�!tu}ٱ��b�.� ���������Ed�'�;�P�g�*���=��f��Eͷ؎�o�?�/�����u�>F�����@���~K&�` ���l�t��|V��\���6G4��?�8��*�4~�so }�Έ���Yn�f��!�;�l�>�K0�$�"U��C��*av�: ;��"�9�bfw���fWo{�뎈ӦW��2^Re�[�~����3���~�+�ٟ2�n!=��_X��o�mΛ_`�NU�#�X�� ��[#�C�2���6��9u�*���)�+��wӯJJ]�����R����#h-���I+RY�0�r�:��!����E>��l8��݂k�.v�b���鐚s�ūFY���!g\���pA��>X��P��&=��d��6�@f�t��|Ug�ʠP0??q��6ڟ �"�Gmnȋ4�`��y���.�VՎDCd�#�;u�������|��դ?F�{��3���1�D��F��y���J.�Z���a�|���˙H���X�`k��M�Ú�镂J1|�'Tr�&h����dΠ���!X^H���1A!�_�upb��N+����ێ�x��8����].�\Rjw��Œ,��.?���}��XI���1��S켈�e�RL�#k/C"�8����✄C��{{��������h���M|�Z�ȫ痳U�)�9Oٲ�w��� ���i�E0��F�����P�5��~��P������=��^�8.��ڠ����*̶3���3K 3?e���z\$�5y��z������#��E��5�N���T�^:.'��H�aw���=���ð��a�����l~�PL�����w�C��jGZc�A3|��#�O��K��R;�Nc-Y�9��F�e�A �%18�.��Q���/8�핐�����q峏��s��;��l�����ƅ�6�.�1ͭ�S�_r"��))�lee��_,tW���6��̲e�BՕ��3��1���s|��S��9����������V��˴T֫H�+��é�j�.�Y(�:P�@s�V */�������;�Ul?�L�X]�[=��0q� Ճ���c(*IA6�c��a� 7qC�9�)���bdVI����+ԢNg�0�g�ۀ8���� �]^L��`ذA���+��{���7�YA�_�5��������2[�9v1�N�o����[�{����R|�%v�]D�#� H�i����Ga4rY���`疆z\V�4}�,���A��DE����ۼ��;��Us3�ګb�|�v�YJ�D�m�т���f3��3��J�-ӧ����2�� �i�,I���۬�[C�;�V���A��,�>���~�)p����ˇΜ�Wt3�WJ��.-��;ލJ���!\��K��}�Dr�Ğvȿ�h�y�7�E[&��H�FF��_���d5H'�k}�%����e����U�R�*A?D�V���K�W<{��Ȩ��}��p�K��%dO3GG���9���p�:a��,�o� k@��Z�Fmfg��ԫ�*��������Z��X���N=��Ф/�0#ĊŎ�N3,G�X7@\� �Y�rV��w�p��d��r���E�t�#0�&�����i�T����h���v⸮����=���*������E���vI���`��n�
Behavioral task
behavioral1
Sample
13850dc1fa39802652aa91c4cc25c5c7fa9cb7966cf3ac88d03de8babb4cedcf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
13850dc1fa39802652aa91c4cc25c5c7fa9cb7966cf3ac88d03de8babb4cedcf.exe
Resource
win10v2004-20220812-en
General
-
Target
13850dc1fa39802652aa91c4cc25c5c7fa9cb7966cf3ac88d03de8babb4cedcf
-
Size
2.5MB
-
MD5
53200f4a9b5d79951d00df1012f3a721
-
SHA1
d98e2aa08fe518c4b92a6b14af6dabfee59d9cd5
-
SHA256
13850dc1fa39802652aa91c4cc25c5c7fa9cb7966cf3ac88d03de8babb4cedcf
-
SHA512
c7f132f592357ee7ccbe668d122dea1a6018d62603476c2f857ca770637258549c96b251404458856f9d66866400e9f5819e4c007886bef6c83407a4d00f8ecb
-
SSDEEP
49152:GpCh0zgZQMabEz/gA3D4K5cwoCVFiK3fcWO4k+aRXgSxLg:/hOgZo44+nVd0Z4Tmo
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
13850dc1fa39802652aa91c4cc25c5c7fa9cb7966cf3ac88d03de8babb4cedcf.exe windows x86
4ed53e2063f998729e69761fa789b80c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CheckMenuItem
gdi32
LineTo
comdlg32
GetOpenFileNameA
winspool.drv
ClosePrinter
advapi32
LookupPrivilegeValueA
shell32
Shell_NotifyIconA
comctl32
ImageList_Destroy
oledlg
ord8
ole32
OleInitialize
olepro32
ord253
oleaut32
VariantTimeToSystemTime
ws2_32
inet_ntoa
Exports
Exports
Sections
.text Size: - Virtual size: 212KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 20KB - Virtual size: 565KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ