0J�zq�]R+H�}���a*���$»��=�� �%�;����P?ys��l��sc .�i��5��_�o�hT�L����Z�76�ٻ��K-/7�la�����h����\�<�J�[ h��(��mW���e��&~�_0b����c�T�pZÄ�Q����}����8k9"x0��>�^(�J�_=�Q+�3���2I��i���m��?=�� �'7�T��x��H�%�5��&�DŽ���V��2\&5v���=\+�\)Gz��N4T�\8'�9s��{G'����E�%rje;�J,�P���7��={a�&�_ �;r�ע�8|��֓H��b��W���x�s D;�E�Wu����a��J��3���^<Y<���7��T5��=;�C�ʻ�2��N� �#�h������5"g:c4�+����Z$��{�D�V����$��&s8�2�� ��Mʀ)�)���mK�k^�� ���Z�%���$������anw�`�ly�w%%w~��W=~�?��s��4}d�RS21���NoI�{z��#ϼ���ZFg���U���Y�|�^a����Kb��\�؈�6�5��k��0kRH�w�6m�Y��,-),��N�,Gp��c�2G��Q���㴅�RW����OyC�U�<� ��S�������U�[����%#���r�G*[ ���lb� �?g���&0#�t�S��^x���zr<�� @`M���@6�'�Z�^�~��e�A��+��$��}'�wV����N��9�о̫=���U܀\%��+�B�7=Ǹ<��x/��8��rjj�����j�dWN�����������ܝ[��D��a�u+ߟL[��ԭ�'�����).#��}I�~�������*����(-m֘�W��0WÈ���/hL< 8��~&J�)MW�W�h�A�S(���X��G�ԙi�i���3y�v�C��h`$��wv��*U��T�7���ʙY=B�Q��+d������}N�X���%:I#��0� U_�V`���*���M���V[�i��B?��o��{�H�w�6�N ԋ� R�Y�T��3��xQv���(��~gOΗ-�_~���|2�p+%B���,`���q���j�'�A�2L��v��Q���~|e��g~U&��u�Q�</d�:��F_d�v��(�+~�$xƢ��8�P����vC�_.@>�y�5'���[��t�2�>䃖Uٓ��D�*�1ǝ��Nj��8�[0N��bm��-�H��1D�M.m�@v�N�����k�'����ܬ��O礽j�|��[��H,t-��з#*����-ӷa1 ����C���k�W��niS����"98�s��ѐ'_6�\��xTY IޯB U���W�'8��Z$������~qv�@��D�*��ι��Fg��K��J�c�(�Ma3 ���/�%�mհ IE1k_���uSf�`�HWr�����m���UAޢ5�g��M�c��9�;��X���dz�N'r�dM�j5G�����w�Z�$J�I��)=���!��MFm�����Cޚۤ��d(�����,AJ�����\&7�Օ�+��+��Y��|�(06T�L�V��e1��l�6ݝ�ɤg �<��Xd��9Ѻ�N�������D�:��A|��K�F�p�K�t���{��Й�q�L_��a��G�D_�}�=���b'T���nn:��%� o�u��紷# Ib:�QS���^�6#�y����:a��+,ؕ�����yF �Nu{n2�#�c��"r��I���*����+냄���*���h����[F`����)�v|'��<�x[`^ f���3΅����@�t'�p5����v�J��':\�h!���?�n�I`�Z~>�zy�B^��ҖX�w��Z�m1��$P6�֚꺈��-@Xs�'�v$y���F��Ҁ�Q0�q� ,<T��e�\Z-8Vf�=���&T>7+�/QD|���5m�_�xy��.��ް o�����0�P!X��/F��٤k\\��������a��0B���H���$>����j`�㷎nY-���!G�E�Z.VX>]<MQ��w�z���{�|�J�t���:S�RP��P�D�ۄw�j�(JD��]閇� �����d�e��g���hߣ���0p~&+�L!/5H��8 y��H��}���Uly�ކ�~-���e|8��w��RP��@��h-����������tV�<��l��h��*��.�Qt�AH-���,8���/פ��k�%]�U�4��y+�,l�i[z��*�#�9�^m��#�aA��F�ZX#q���g7*wb.��:]����(D��\�Wn����@�u�f���fDp�0��3�c����lNU�L�WJ^���µm4)��!� ���6+ȑs� gR��)��Q���ޫ��$��uP#��0>ɖ��@��sD*��a����O�����Z/�]6�`p���||�fұj�+�z���v����1Xڅ�pz,(�^S��Oz.!��tSrj�:$�o����!���g��������1����Y�/f�,{z�������A]T���jfg���?,{g��"�Ω�'�����be�g�Q>3�2_}.�Q���x�b-�� Ga�]N�==�f���-j����_W�6� ux5'Zpd���B�ʼɤ�9�j�������B��zs�vbKW]2�lW����U�2����3 ��J��(Xa%IG���Ο��`��t��br�z��-~��?:T@� �@e|���'�Ȣ D���=��U��81|F���3�w���撺w�=�ܨe�m�p B燋&i^����pR�O����J*��}��:��,�-� ]c�H��i�����a3����m�6���ޘ����{��kPL�t0���Ǭ�PH+��|!��d]ŭ-&�p@�!� ?������T��zd7 ,�ȅp�t�����Ji��o�*��x�s�<�lTT�p���m�hr^��7`��8�� "k�/~e��2R}VUva�R�W���Q�V�Z�Ѥ��6���뒦�s����i6�cc"��2�0�����^�
Behavioral task
behavioral1
Sample
f590c3ea4fa382e7958fe7df9a336f12b083227ebf764bed8af822587ad42ced.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f590c3ea4fa382e7958fe7df9a336f12b083227ebf764bed8af822587ad42ced.exe
Resource
win10v2004-20221111-en
General
-
Target
f590c3ea4fa382e7958fe7df9a336f12b083227ebf764bed8af822587ad42ced
-
Size
970KB
-
MD5
2843e920fd6f7e5fb535a2114ca27ea5
-
SHA1
e45f569b0946883564f45bdf03ad7e2c49fa08a0
-
SHA256
f590c3ea4fa382e7958fe7df9a336f12b083227ebf764bed8af822587ad42ced
-
SHA512
0f5c1e7a67e6816c2167e6a785bd28235b175bfacf838b9ea467927f25a5fab2e49c63554d6ae2eac9632a70e702d7604f6459710b08b803b6d0d973ea6a948f
-
SSDEEP
24576:tOvxMQo+xqeZ1Lzq/kbLvetLPItmIKdmbyA:tG+ZcqYLOi4L+byA
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
f590c3ea4fa382e7958fe7df9a336f12b083227ebf764bed8af822587ad42ced.exe windows x86
9152efda8668f4158d1e60af3c7a546a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
setsockopt
mfc42
ord3749
msvcrt
__getmainargs
kernel32
DeleteFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextA
comdlg32
GetOpenFileNameA
advapi32
RegEnumKeyA
shell32
Shell_NotifyIconA
ole32
CoInitialize
urlmon
URLDownloadToFileA
imagehlp
MapFileAndCheckSumA
wininet
InternetCheckConnectionA
shlwapi
SHDeleteKeyA
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 756KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 870KB - Virtual size: 869KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ