u5;r����-�P51�F�ߣ�"S���Fٱx�� |t���v:R������ !��Z����j��Z��@�m���c嶸���x\�3� ����8"=�F-����u��-�����l�Ϟ�I���[������|^Iv�IaaY�#��[)�?�-\�3���e�صt��k��E��H�n$�n_���2��L�O�@b]3X`{^�5�h(��ٻ�b�ݭ]S����s9?�n���g��RLk I�����=���Vc��W=>�c���m�vk��������E�@+7�g"e�R�i�V�\����c�b��Y�O��P��r�꩟K߇"Y�����\�������|A0��ƎC�e�;��Tc��:����:J�i����:�&:�}8ٹZ���z��"E�� �Iǵ��D��6i�����1�/=���$�ڡ �O�13wA�]��d���5��|@�b1���B� �4�IE`�!�q�T�Z�Kk'p�ֲul��5�� �����a��k:�.�bu������]�� ��wK~�V�K�>�0���SD�~1s�K���UO��C,�9�5��"�.Vt�R�m� ��P��3�o0Dk3g��]yYb�a�-t*8n�qf����6����7'�98�^f��MK$��㌶��!�&*�,��k4�ӱ�����Ƒ��p�a �y������ a"/��Ƈ�ǔ�C�O�m��-��;�B<7�f�7��q?���5�i���\u|aF��QH� ��J�j*��%yKFnUŴ|]?������|�^�I4 4�tb�NE��sy�k��H��g��;i����������o�a��e�O��Fn�~Ar�QU��tׇ���e�� 7��I��_��F}�+��E)MY�1ߘ�5���`�6x��=�t�N蛄� ��`[�MZݠ!ب�c����#c.}�Ed�����7g"��]��!�!��o��]�0�ږ�D�AЍ����x���ܗ�Q��ϵh2_$L,5p=;���F;��<.���:}O\�[k\���Ӗ+���z��d`*�@ �QQ�����2|=�������r��Ta%�"���I/Q�V��p?y�i<�}��J��",�;�;�����j���E���/M��������7D/����R��Iꢫ��j�c�e� ��;�T��i ��b^S�i⼞� ��<�^�ӕ5��c�W4m�*����Q�A�hm �%���:��)F�k����6#A>EP����pWl�^B�uk�A�E(3�R O�} ���A���h��^>?�{O8.�?��vP� �_}R���<6kx�"@�+��+v���O��1qu���F'҃�h�4d��E��>�S���x���z���12</\��=�����Ϭ���W1� E��@M�BjF?�܀��@=���@5ĸ�]Ŝ�?E��3P��֕����>�2��ī.g]:�uS�hu=��O=B��Av�.`��z��v�i�+� ��8�a ��T=� bG��p�����6e�C���d.4���a�qs^����s1�hz�,08��z[XŬ+�x9=��V,�����WȌp�*Z�lҸ\�r+�h�<r�V�q�O��z�~�e��̉� 鐤K��0�=��7 O�v��(Mf���b�!3�R�n[��q���R��h��cꪑ��rVi,��̦���I��4�rC Y�-us��'�U������K]����Z�c�=���z������h@J��h�,?Y�eZ���>A���]}��XHh�����K�����u��+F+ދs=��?��d�JF*���l�3�f�D: ��t59�Dĩ����4�R�gJ�h���J��)Ū �3�0��|rx$C�U"ߜe�1jƒ����'T)�Cf�wh�o͇C�g���}1�lu��$��3�y��cStb�/;���F ���� ��ߨ^N��2����xsf�>u:�;Q������4�����&�t�����o���δ�W��T+����q�U ������l�Ȁ�o���}�������*@����~fd)zŲ�z��3$����Rx�*c�2�(hS�R��*�W;�����$x�HŦ4�k��aW%��@O�?�RD��CE�j�Y\4Y�I�`�m"Q��z�ϣ\PKu%\�҈(5��),!�֗:�f�9oJ~������]0�w����U6h_(���I@���ߞ����'i@a�}'������T�z&��jN8[���Ø7#�!9d|�A^��xZ0eb��6�=��j��(���t��aJ@��7nA�4p������A�g�.;[[/?��(���㩢W�<&�p� =��}� ��FN�;X��5�&�դ����u�����O�^���B~L����-�} 7a��y�M?p��i��(�������R)pR��bȘ��'{�^y�(���.���Û����`����z�;-�8�ؕP��"���ڱ=��};r2Wuj;���70�C�P�lD^�?`�Z���n_�0�˩���O���t�y�q�R����g$���sa^�G������-Ҿ�8;Z���)`x��E��Asm��_�݈}�P�W9�m�/kh(�km`�m+Kv3�Qb�S���a�:��nr����4���4�E>@�����_��>�hW��Y�U�+ ��,bh��"�� IJ�W1��i�-�P ��0��r· ��(};�f�<����C����U�d/��#?��jCx�j+�G%s�������W �G�f&������J�/Q����*�?`�S�$%��n��$��o�~x!��%��t��3����'�T C��u��$.��Lw�Qۍ�y���QJ�uw(q�*��!W�A���������C|R��~�����刈zg��&i���=�!cM�/��8��X"Y���M����?���y������$��-w�=���Cc-�a�1q���FɁU�X*(�|���Rl��%�}1��� �k��7�a�[<��C�C�I�CF4NȷY�mm��|Ajo���E IN}1���S�G�U _���JNޠ{�x+ǣB�
Behavioral task
behavioral1
Sample
84b072ab9259855c11e9df74cf0d44cd91702009f052dc1475d421bcb1b2b07d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
84b072ab9259855c11e9df74cf0d44cd91702009f052dc1475d421bcb1b2b07d.exe
Resource
win10v2004-20221111-en
General
-
Target
84b072ab9259855c11e9df74cf0d44cd91702009f052dc1475d421bcb1b2b07d
-
Size
576KB
-
MD5
383d245c4715dd89033603be6e1ec3f4
-
SHA1
d992b5e7f2080c960247c6809b4c7140c7b3142e
-
SHA256
84b072ab9259855c11e9df74cf0d44cd91702009f052dc1475d421bcb1b2b07d
-
SHA512
8a77b6e5a0fc4318fa902e0b4ba78dc3e4684ae5746667c3ac8ffca2f15cb75952f0452b138b6aaf84268e887e2fcced2452c22682f7cd61c6a9569378217214
-
SSDEEP
12288:PWTmT95UkDH0wGlMCxlece384rRhKq4u/ZsMBikS6u4a3vT5xKz:VT95Uk9GlMEeclQhy5MBK6u4ab5xKz
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
84b072ab9259855c11e9df74cf0d44cd91702009f052dc1475d421bcb1b2b07d.exe windows x86
388e453cd080aacd5f69df946cbd232d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowPos
MessageBoxA
advapi32
RegCreateKeyA
shell32
ShellExecuteA
ws2_32
htons
Exports
Exports
Sections
.text Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 661KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 406KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 481KB - Virtual size: 481KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ