'�]�r�*ʾ�Ǹ2Ɍvw@+�M��㊕m�J�lf��Уƒ�r��z�؊U�l7��0��Wگ�z��)x,�Q���ⱙlH�l�_ÓuO��H=/<�z��I��@绁�o�S!�_����S5�PRB,��DC�9�D#Q���qn5����� R�u9� !-�l��S�-��&�ib�{M�]`��)MWw?�i58�tx����L���)����Balƨ�䦗�C�%7�>ڸ�zնR���_?s�s#A�l�������s�� �11�=�����|��w4W�to}m-+%K��C�V���k��H�`���� �6Ҋ����ߖpR~��-�ɻ�n�3>���m��$ݭ���`����b����$�ܓ��Һee�}�^-���78�l��/���������/�e�k _����6���5���8��#��z���i��V8M�1Z�[�o��'�)�U�L>n�R s�v+����~y�����{�A��e5�5E���ma��U �c����eԢŴFY\����<9�7S#2l�$ �k�<n� �-���O�n��J���Na��I�O�����>�4a�i��'���f��rD& �V+"�W���}����@( ���\7��}\9Z�k��B1͞�D�Í��^��IFqt��y��D���1�e�%�q��L�H�u]S7|Ya 'kh�6Gf�@�>��F�I�I�+\���f��-�(�F'�*�Y�2�t:�@x'�H�c�r0l�33�^<�Q� �:u����&�R������믺*0�L�$�)o���S}�M/�F^s6"��=pa�_�\�����8ӥ�1�ڸ�'��]\B���t*p�4'?��u�7��Ք^_ƅ������ .�Tn�}8��� �nJ��-���r�l��� No@O�����xeK�շ�:���ԏ�;;�ѫ*8Y1Sj��������M�������ؒ��`����PĊz|y��c��XŢU�fv�2�w� C@�``�luP�䦍����J��#+����GE�x�W��.Q�vMːk��Jf��;F%��|�Ծ0��v3���իBW���3��?������[��3��)�ЭM�1y�7ˌ�D�%���hL�&���Fx�q7P,�7��#�d��J�҇��x�ؘ��C��H32[4�4d���1/���� �#�łc�P+���%�ג��?h�WW<�! ��A��|[�4����|c<��Ư�Zu왧,����� ��3���y0��Ӑ.��`7]�8�&����P�W� *>:��n*�1WJ�(��P��o�&Nd�m4�5�DQ1�Ɔ��U,�=+�7��fA�̅��.�h�Fcpӌ/9�ܬ��vlgj������"1�����bDHn��WHh/^�H@í�*e��Y�<#���� �Ӥ���-WaQA�5��6}�dhS�˪燺%Т��c�}��SWOtQ�s�-����mKYTU?���5s�f#:�H�����ټD�U��O^6��0�hbhC"��<�6H�'UI�xؘ�q�s�&�5�d#���w��U�!����E؋�f[��r;�������������0w��o�2s�D��g����� kC�Ұ���0�{���^_�s���[���L�j�ECV�? h�I0M`�ź��F�?j�������4��G���xT>����!?��,*����\�vd�-�=�{�$�k���I|G`�JM}қ�Ʉd�Z��&Xߐ�I����L9!��|v�/fc�����5�@�� 5�Oh�IVmE��$<3�;X�SU;7V�Z�m��z]܀��Viy8ܮ�53<Fm�)v!S����$FI���Bh�J�ȳK�K1�}-B��.�m���B�c6jvzG6WaF>��j .`t ���F;u�"zK�� �[�j;������f���4ґ�&|8���Vs�~8h�v�`m�@2v��5��,�{�r������V��I~[H�W�p�3�4b��{�Z�QR2�����[S#�������n3�5,Ԣm �ϥ�&���%�jf��%����ݛ6���l�'=�As����`/$�Q\|�W�)��]�ӼS�dyƛ�m�.��>�L`1��0����n��Pl�Ai\tork��b�h'�-�#�8O[ �XV˙��e����$5Zp2���̑$����j�T�Р�/�@䥣��"6�����< �ۮ�ǿY����l�����g|+���hކy�]k�^��S�2�|�πw�2U8��\J4']��٤H,p��m�[�ĵNlԸ=�(�ӕ%���YACPg�Yv棪bc�-S���5��{�Eɐ���A�Bvد����%=� *+J�+��3����O:3�������-s=J��G�y��e�i��:���{�(�Ӏ�G�g��E"6ԥ{]jD=.d&�w�D��?�A��x�����QI��<�@h�{�ڮ\[_�czڀ� ��BX�f���[s!:�N|;q�j��F�K>�k��e�6%(|�Y �6��#�-����.��lp��fw��Z`��_Nk��$�Ur:6� ��b����_[�(e�������;k :����g������V���'�9~:Y�L�a��@���ж�sVuE�߁ |(}������4��� ^h?����m�g?5s����uO��k,�#����J��_;�k�:}fdQ�lk9���l��y�3�n~h���O� �j �����I�.��X;�]jfEcNX�� @·���PT��&'.����e�� ��e��2�x1��qɄ��,`���~����˓kE��� #��u��ej�< �u<m����R`��:�IS�\ y�<�v�xl�Ԅ���i��-0�ж�Jg�%���Д��P�tbR1�nAn�y�W�}���� qT� ��iR"�u:��!)u^F!N���s���Ǹ�z�� x���x��w�9�6F�|mQ���ާ�v����g�"m^[{�Eު5׀�=���g���k�[94K���H����x�S�����m��+��tW�Ԕ8�/ʾ� q~�j�ba���u�+�e�&o>-�,o��oi
Behavioral task
behavioral1
Sample
ebd92acc64d4c2f913855568d7d1a8ca1b4064dfc856161761b6dcc7f6c77045.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ebd92acc64d4c2f913855568d7d1a8ca1b4064dfc856161761b6dcc7f6c77045.exe
Resource
win10v2004-20221111-en
General
-
Target
ebd92acc64d4c2f913855568d7d1a8ca1b4064dfc856161761b6dcc7f6c77045
-
Size
256KB
-
MD5
688e4a585d47a6c46fa1784a9bb070c5
-
SHA1
e2f8f4a1edf5292311d741dd7ac78155a8773420
-
SHA256
ebd92acc64d4c2f913855568d7d1a8ca1b4064dfc856161761b6dcc7f6c77045
-
SHA512
ac45df92e1ba3146c66315c304ec3252c4b7e5713fa24288278dd01984a7378eecf98bbc6385752bca391bfbd96538f6eeb92699ce949206d328c6da688b1846
-
SSDEEP
6144:M/N8cr6fQ9sVEZSCQOD112ANPpsRZQVG4+Ao77H8w:M/VrcVENQODPHNORZQw44/D
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ebd92acc64d4c2f913855568d7d1a8ca1b4064dfc856161761b6dcc7f6c77045.exe windows x86
8a4375a9a88078e77c0e4e99d036c423
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlUnwind
RaiseException
ExitProcess
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualAlloc
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
VirtualProtect
HeapAlloc
HeapFree
SetErrorMode
GetTickCount
FileTimeToLocalFileTime
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
DeleteFileA
FileTimeToSystemTime
GetThreadLocale
InterlockedIncrement
GetFullPathNameA
GetFileTime
GetFileAttributesA
FormatMessageA
LocalFree
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
WritePrivateProfileStringA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
MulDiv
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
LoadLibraryA
SetLastError
lstrcmpW
GetModuleHandleA
GetProcAddress
GetVersionExA
GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersion
CompareStringA
InterlockedExchange
MultiByteToWideChar
CompareStringW
lstrlenA
TerminateThread
LockResource
WideCharToMultiByte
WriteFile
SizeofResource
LoadResource
FindResourceA
CreateThread
DeviceIoControl
TerminateProcess
CreateFileA
Sleep
GetLastError
OpenProcess
GetCurrentDirectoryA
SetHandleCount
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
UnregisterClassA
RegisterClipboardFormatA
PostThreadMessageA
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
BringWindowToTop
SetMenu
TranslateAcceleratorA
InvalidateRgn
SetRect
CopyAcceleratorTableA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
GetMenuItemInfoA
InflateRect
GetWindowThreadProcessId
ShowOwnedPopups
GetMessageA
TranslateMessage
ValidateRect
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
GetCursorPos
ReleaseCapture
SetCursor
LoadCursorA
SetCapture
ClientToScreen
SetWindowRgn
IsRectEmpty
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
EnableWindow
GetForegroundWindow
GetWindowLongA
SetWindowLongA
SetLayeredWindowAttributes
TrackPopupMenu
GetKeyState
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetMenu
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
ScreenToClient
EqualRect
MessageBeep
GetNextDlgGroupItem
DeferWindowPos
CopyRect
GetSysColorBrush
CharNextA
UnpackDDElParam
ReuseDDElParam
FillRect
LoadMenuA
LoadIconA
FindWindowA
GetClientRect
GetSystemMenu
AppendMenuA
IsIconic
SendMessageA
GetSystemMetrics
DrawIcon
KillTimer
SetTimer
CharUpperA
AdjustWindowRectEx
IsWindow
UpdateWindow
InvalidateRect
GetParent
IsChild
GetFocus
GetDlgCtrlID
GetWindow
GetWindowRect
GetWindowPlacement
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowPos
CallWindowProcA
DefWindowProcA
PtInRect
SetScrollInfo
GetScrollInfo
MessageBoxA
gdi32
GetStockObject
GetDeviceCaps
CreateSolidBrush
CreatePatternBrush
GetRgnBox
CreateCompatibleBitmap
GetBkColor
GetTextColor
GetMapMode
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
GetWindowExtEx
CreateRectRgnIndirect
GetViewportExtEx
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
GetTextExtentPoint32A
ExtTextOutA
BitBlt
CreateCompatibleDC
CreateFontIndirectA
Ellipse
LPtoDP
CreateEllipticRgn
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetPixel
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
OpenSCManagerA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
DeleteService
ControlService
StartServiceA
OpenServiceA
CloseServiceHandle
CreateServiceA
shell32
DragFinish
DragQueryFileA
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA
oledlg
ord8
ole32
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoRevokeClassObject
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemAlloc
oleaut32
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
SysAllocString
VariantChangeType
SysStringLen
SysAllocStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantCopy
OleCreateFontIndirect
Exports
Exports
Sections
.text Size: - Virtual size: 233KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 228KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ