b��Z7�OL;QJ�������p�+M�T`�6<��4F���Q(T��FW@3�=l5~Opd��☷]<G����,��S�oⵗSWI��¨5����U��g �ϰ4z�Z�+F�0gb6b�W�rKGt/�.��Q�z�����F\��qග�Ʀ��cY�Oi�!�mW����-�8� !>��)��2�D8~g���9ٹ�زz�Q9F����BO��ɺs�Y�(��gP�F��F�@�C�o�:�6��ڄ��8�/�3�Di^? �������c'����?���I��R��s�������sb��$#�$����]<���0N��y,-ӿs>CU�̿5����v��In��|H92���O�s#�;ç�W�U���嵰�ߍ�QA���5@˾��?%�9���g`��Xx[������ǥ� d��9�|,j�$KM�sI��1xΤ���d�wnȆ�Zy���oZ���d�;��$�vvg�����</,K���r`�^!����Zw���B��ֳ%�߂��j_��u'�����֪�|1�` `�XĴj���Zk��j�=�7W���,�.��E���|b~�uI\*}6�F�oE����m�(2%=�4H =� U��j85R���;�\��V6z�[���м��e��2w�b�i�������+��j:��5�,u��u�����]ھ�wXR��U�x؍Z|J��- u�����\D���ZA?��!����7�hG�b"�Κ�Vk��֞������^�=-sb�W��&���� � � �#�]�J��*a���O�d�M�4!c-&��SG���V���!S��s=���L ����(�-�Γ�R��x>��eJ��,�騹A�����؍��?���J$Ѡ�\Ǩ���.c�ᢎ��1!5�_P�����Aյ㾫q���[za�i�*�����0���o�(wE�*%#5zY(eZ���#���4�~�p��g�u���;��X��h<J�G1A��������8�� 4mŠ���1B��ҹ�Z��S�E���<Ԏ,����ґaЀ��j�s.+� E�.��m�� ����Ķ����t9vC�p]G�gL�Ԍg�U�����(w^��,���O���BQ]�X4; ��M�Y��z�ם��!k�T�Zhܭ�*g��.�M��UkI�G���# @�6�~�s�)$����\�NB%���Zچ/�t�,a/��qBvR��`�Ž�-Te���^"~�V���[��럕l��1u�(!è��1�".O������zV���w�Yu|D�lE=����"�Ca=�"��[�P���)�$+�gE}}��q�0r��J����$��{F��'�wc�Ҩ�-Hੲ[�b>��h@�.���YC���X�J)��ʑ��Y�/���_�D@�SI��V�zT9���qC6�t� �l�g�.$M������o�"���t�?��$Wcϛ��%5�T��4�1�Oln�<�xH:�^��xP� mv=��B�MQ�"�"���7bsY$q�h�'9d$����I�ѻtC]�,�?����ԉ��'��H�up\��.H���D�3���ԟ��qU��g����M$wa����h����;O�=�lŇ��������@���h�k�f����|>dI^a�~�cf�C���ycj�ɩ���9��֘�l���~!�@[� ��(�^�{m��������cL�g�Z�K��Rf�������v���ԆMRx�鍃~e��)����D^K�Ft���=��V4|�uk�?�dV��-(��7c�g\�%��:���S�����H���� �R<��!�D��S�sR���^��Ƨ���x�"� vJ�����6�?!�ӛ�f�_������@���C���l���ߩ����m��%SN�]�͏z&�͟�(z�ڧqV�t:E��>��xE<�I��_�����B%��O� hZ�#I�/��z2�^ �n��xf]2eP���{�^z D�jB?���H&���Ц�,S �ϲ�,�/҈<���zak��4�g"^��s-ZH��*,�?���ݛ��_2�6J:���N� N.�� ���L��:�)����v�C��n�UɡXG����U�B�$-�G5�h�{'�N���pV���m?�{ܥ�{V��us��?&A����M����=w w9&�����;+Y��ގWl1J,�Q��V�Ν0�S���e����͑[�9(c�+K�A���VfpZ5��d��8�s@��%�W���>5 8�c%h��h���[�u,��.#��F(v,R�n�n^w!8��]����3��a]��j����p���� ��y��8ڒ[��$~��x���y&T���R�u�٬)+����?i������MeEBf�(�Y ^��ˆq�}��(t���H����#+W��v5��#����B�U�G0u�\M�./eG+t�0�5t%G6(��b���0%��y(i�4C�F��#����_�A#�7NAwʖ �mX�]km�{� �(s����4� #4y��XI���-�.l��y�0��I�����T�.Y*V���p�G�m�1f�u��:��Oa��DY@oRc��|�1x1��1s�t���1�d�H�K;͇-�k�o�H��#ZR��"4�>��+(�Mc�0���!3���b?��9�4b�`��i�藏. �0̊@Vo�Ŀ�����4Z/j\�>�fO��;@ɓ.7�������G\�0X8SH?p���I�JB�����Њ���{2�3>���(�ml��>�6���˿�A� gCM�P\x�a���8�9 ��i���"���.���̊sRD�j�R�pX��8�����e'2Bţ(��C3���OuJ���f'Ɛ�ho�h���u���%����bfu�^��[�}�b���z�CKZK��x���h`<�{1>�*��M�Q]kC�����Xl=�� -:���x�͖�ܿ� ԆN��hp���B��x�<��" �y3����4������+���|n��Y���B��k�~���`��������@\Q(ψ���u'i��@���>���aA�L��ՃZc��e"&���x�
Behavioral task
behavioral1
Sample
ec3e081d331c138356ed9fba702045a1dd70a6885cae03d51e912e2b86babafe.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ec3e081d331c138356ed9fba702045a1dd70a6885cae03d51e912e2b86babafe.exe
Resource
win10v2004-20220812-en
General
-
Target
ec3e081d331c138356ed9fba702045a1dd70a6885cae03d51e912e2b86babafe
-
Size
472KB
-
MD5
7cee1a7cab9cf6a18a6fd7cae4fe7c75
-
SHA1
2d81eeb6bc1b53b5f01b8e1392025560e83bd94c
-
SHA256
ec3e081d331c138356ed9fba702045a1dd70a6885cae03d51e912e2b86babafe
-
SHA512
42763721a5fa72ba776dfc9656f7b0dd3aeb86c6f88ac748936336b7b470bcb593247ef3cc71f8fb126f1c5234a2ecc944fb0f31d761fd8342c0f5b0c29a4dba
-
SSDEEP
12288:zAxdnQWqQN3kcDep6lorBgSGetTx+7vtfgkBFlB:zA/nQDQ6pOSGePetIkn
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ec3e081d331c138356ed9fba702045a1dd70a6885cae03d51e912e2b86babafe.exe windows x86
5751380988e8c3186017bd11d420ddac
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc80
ord2394
msvcr80
_crt_debugger_hook
kernel32
GetSystemTimeAsFileTime
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
GetDC
MessageBoxA
gdi32
GetPixel
advapi32
CloseServiceHandle
comctl32
InitCommonControlsEx
ole32
CoInitialize
oleaut32
GetErrorInfo
msvcp80
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
winmm
timeGetTime
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 440KB - Virtual size: 439KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ