���\�?sܮQ���ʼy���l�Di��`i. ,��O*�%+��^���$��_;p���;���ߕ욻���8�,�X���G ^��������S�j���ډH�33�� =�*cՆ9ׯ9�/�JoV}�a-[��й�-ڵ �*&���D�T(�:�����B�A*�=�^��L�������1������9�>U|59�^�r,Qe�� ���.��6����v�}iwo���s�*�̫:f�^t��(�R)��k�.Cŵ�U�����U\��m/����z���\4�!6 �D- =��ْ��7(�L��ռGn%<���1l{휲��7JcA:H{�� �Խ��ɇ7[r�=h���~��.Uw��%�ϳ���uO�P�� <��]����鑆��!��<:q \�@==��a\�&@�_��'FD��.d�L�D����۱ڪ��l~#C�߱���j��� ����'��넼���7i���e�nدƬ�O���,��"EO������3?��EIa�/�8R��Y���7����Z����Imp������c��V�ߝ $�ؘ��p�R,���sr�wh�s�����!3�VlI��ѝ���M#e���Y����Zr//<M��q��ᄌ��g>&C��<,]���>a�Z�Ϛ���{x!�S�V"K��7 ҷJToB:�r�~�~lHc�s�{ A�q��ڝ9 F��@����t�f_B2��#N_��ߛ��W��=k�z���ǡ�Lt͙����Sŵ*)@�i�*v��pXJУ������B51.���ϣkW���f @���� W?��l��U4@]��k�x��vw��R�$e'�zމ��vE}e�!u4n��%G��c�ӮzL�zn��X����)�u�K�̺���6�$�9C�NKw3Q-�nX;�JG����C�"KC���=�x�s�P_z����+≯RA�jd�'$�`�Jt�+Fg|u^r��4�@�%H+��4Y�i�}Ekۙѣz���1vïߒ��Ӱ�A�y(NB�i�����9�E�-��A�k�C�y:g�I��E�����������dF�>��̕��_w��� �vo5�.N�.��P��z� 3��~� �Z-�X�P.'��FH+:����u��_�:�w~!*QN*���I&�J��)�Z!���UhV�dP{���n� �dFS��~����Hq;?�UX;�ǴG����&��U�Ҏ�K�+��adײQ3/�g�-���G��'*��1����s.zݱ�Նv�13Ay��g�$����g���!����*�e�����3=���A&)�Bx������9��f�I?V����+ٝ�� W���q�[�@0?%]��A���-�1n�#���;��A��%�v%D�����$A�?֩�8�)g�M�G82������C��+����WJ�!֔R��}Y�����'�rW[Yׅ#J�$��L'����0�gn;�j�z�~�lԂ�F��������� �*��w�٭p.4:~'Lh�q�aHJ��4��{^8<#�#zz8���{���ُ�1#�ý^�35�#���)��}��5���x��K��II6����߸ݞ�N�����HA�(UϛѪ{�$d��fJP��1�� ]^��.5�F9��廮�y�a'����M�����?{g����t����`z������Y�Rg�0IC\?�,�J�����@|B[�[�e�Y�:>�OG5��hW��+&�}N�搄b�9�X���Ǒ�m�n �l���tr1$���S�K5B�c�&]@Оpr��%yr����c�c0�P�ޮo7T�F��W��=�\+a�<��ay��+ r��|#a5r ۖ�X1��[���48}��/�D3�8�؍v&�99]@ :3�Ҍ�����N���z>9��p�jDג�m-�+/����#ӏ�j]i9��D�(���SKp#��/BSO��� *Q�ͽ0�.�p��W� X>>�^E�}͘Z�C]*���i�t���Ļ(VLH �s?e�7��L���ljU#= �RU�]�{��ρ[~��h�����a���]}I��9���vA�-�v�O23'-�BZ��$Qvcڣ�L���6B�Л�V�=��`0�Xܾ��s\�O~���[������g�4��� jc�YO.!�ڲ��y���4һ�S�����v��*�%���@�*�u���<?^El����N�`���v��ȶ��E�4� �5�Wi{�D�uF����߈���ɏ*���2��w���vJj�tc ����ɦ&�R�Z4��ݢ��2�/Ԯu]C7�I2��A3zt�F���9�aQӪ�߷�F�Tx�?���'����냂�j�q ��4�ð �6k$h�c��B�5��fr�����nէ�VoX��[�<�3���yUZ���C!%X����at�W��?R��_�lg_�X��`I}�������i�����-�Rg��:ڹ[t�̐M�*�Ò�Y�|�^����<?z��>�+a]LEF 2&�0ňy]�]/��}P��[�����:4�qz�ȃ�ߑIt�P�2���j�����G�c!�w"�L��L����SRq�lv���M�w�5^�۪�q0d��A��S�-��T6$���02���2����@)�� ?�, ��/ 3����%����O�Sͺ�ƙ��ɍsݰ$� Ű����9h��i��O=��r�;�����'����g�ڠ��0��6F�� W���$���r �%9���x"ǥZP�(8Y^}��_��N�L/D�����F���� k!g�����.��$�k9�̤�ƻ��a��0��JK3ް&��?�s�v��K\A=T0�($!��L(p "�����(Gg��@�렕R�3%U���֦/���B����&,Yp-��� F�)[ �{ؠ��2�L�VA�`јJ���h:�:%�hzF:G>�B�W���"���c����y .M��߰Mn���R�@��g���>�o^e��.h�@ ��U��Wjo�5m|����~������7����ي!�g�)�$"��n,д_Y����ҿ�Ri����-Xz'�?
Behavioral task
behavioral1
Sample
ff2f7b9c1b5648003631ca737b155174551e44858df596c4c8fbdc85810cc7b1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ff2f7b9c1b5648003631ca737b155174551e44858df596c4c8fbdc85810cc7b1.exe
Resource
win10v2004-20220812-en
General
-
Target
ff2f7b9c1b5648003631ca737b155174551e44858df596c4c8fbdc85810cc7b1
-
Size
320KB
-
MD5
58998e274392931d143e6250d86d5224
-
SHA1
8d8581a99376af02b625a0078d006f82d1c52e85
-
SHA256
ff2f7b9c1b5648003631ca737b155174551e44858df596c4c8fbdc85810cc7b1
-
SHA512
e63d2d15ba881fdb79188a9e2e0b55cd7938e395b0e9ac62fdb564e9a7ac0fb7e06a3158bfbd2ca516fa2c05fac6069e8c38b80e7d4604c48d829a23e767edce
-
SSDEEP
6144:KWuEokS9pcytnco9SZGtpFQkuPYtAHIMaDC:iEhS7ZtnVSgtpFqT3aW
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ff2f7b9c1b5648003631ca737b155174551e44858df596c4c8fbdc85810cc7b1.exe windows x86
fbec2def0a3fa8d5aef987e194150553
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaLateIdCall
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord626
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord667
__vbaAryDestruct
__vbaExitProc
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
__vbaBoolVarNull
_CIsin
__vbaErase
__vbaVarZero
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaPutOwner3
__vbaVarTstEq
DllFunctionCall
_adj_fpatan
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
__vbaFPException
__vbaInStrVar
__vbaVarCat
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaVarLateMemCallLdRf
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaI4Var
__vbaVarDup
__vbaStrToAnsi
__vbaVarCopy
__vbaVarLateMemCallLd
ord616
_CIatan
ord618
__vbaStrMove
__vbaForEachVar
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 407KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 304KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ