L5�SEA̘ //6�j4 CP�(��0�B��[���\�_=��Q�[�Vo�i���샯��&ݚ�i�����Up~�/�!Ԑ~r49X`Y%J��uvp-}bf<��e� �)�������أڛFٻgܾ� ���T�w�yB�k������Uh�t��x�k�N���A������)��L=Mp���̼�I��r��4���D�H��Yյ�1���+%ͨId)�7 ��qC/5g�N�T�DM����� ��� <��3m����V�Uw�tߧ�MJ2{��?��߲����Ϳvʹn��]��bS<�&ã�#g��;C3�p�v[g�%��;���?P��<���C�U0��������Pw �K៝�K+���~d�'�8ȇR�:ŷ�3t��.n���ѷ�����q�[������e��$��v�z�b��A�(;V l��&kh�����Հ�q�;�n���n��F�8���AÈ���@��+o�Y���wˊdq��cmؕ}wC�*���v�W,�"Lb�1e��g�i�T��9R�;b��3��ŎQ����:{�[��H�a�o5��cbD����2�V��U�[=��Ը N۫���F ��� ҚѼ̓g�g wj�{mH�@��L�E�%zC^D����z�'̤�6X�:$�#�TL�nT�!@D�ٝ����\�1�Y��!�������tN(9�SRхg�Z�N�d�|"�'Ȇ]���.nԨ�ڂ���gq5� ��N�J���IԿ��p�2|Jdq�4�l�"�~znTk�7l�6�KΧ��M��V%�;R>���O�'E����D���)����M��P_S�G/����/d��Dn�@�� ��>I��E�ĵ��t�� �{QU�Ư[٩s��QM����7�$=؈)���#�煜�1{�� �HY�H����3d��Zv-�@{��@ ،ٳF��⡜��-"Ӱ:Xm�{�$���4���dh-�t�c��C�u�� ������r��M�w&d�U�w�� �̓Oo��x�N!���i�Smߙ��MeEH�s5V��_x)�����4��x�5�Mb�mb �.ݵ2��y��^�ܟ�b���G��� ���x��Y��`;�'y,C�«ƽ�M4p�Gg=/"���E�wv�SV�sM�wt�HKT�����DÍj�@��M\��f�<��/,�:��5� �vSi��f��Mf����o�������:�P�kӶ4jK]���L�����?�-�� <��{.����QI��� ��E��&�S�� /���ud�!zz�8��Y�/Wr:ͪO���y)=��d<�UЀ>��Q�IrM6n��&��ly�5B�#a�*L�M!�$�*$m���U�Ɋ\�/�ûa�\��pԄ'�2���!������f_�'y����S�m���P�r���(qd�� ������o�Ht���Ct�/̗�=�kC(L`�$���D����KWW�>��$k��A�m'���*VoXrlP]���E-{nQ��*�(��.�� �u�r2����jϿ�� ��Rᮟ�ƽ��n���!�֢� �(�3�YBJ���qf�$Uf�����!�^w��!��I����G���(���h����a��W�tqM�c4������+��';xi���]MF��كBOm�ɯ� ����P�: �;�hҔj���N��/������ 30 �A @a��L��)P����#'�zí+Ut[�� X�EN��u��m �����uwM�t4$�C�q�;�L��B_�mC�ـ�O����*ms����٭��r��8���y��1�η_�JP�A��nt��~������:_̼����A ,������{Ѽ]��3�`��+�\����HHD̈́����%o��/I����v����9/�4m& �O+�&�s�q��0�6�Bv �=�؇8=ƴ",p�9�6^7�e�ҍF���Hfw�C��dkzШ�W$x� �����&�4v���ˇ�(p�s���y?Y��D| 9�O�����O����툟�8u�f����)Z�T���J��l�ہ=�6��X|���5���[�\5��-U�����-��SG������!�B4�o�c��AIؠ��UJ/���qjֲu�.���L�W���P[m�Ao���s+�� ���b�u)xxok0!��5��lSG��ނ�o��kN���8�Lp�*Z�f�A�L%��^ S�ks��D.1����q��]2�+o�C\� ��k �,����e9�G�X��L�M�VS/��#@��B���K�{(���EUy,J���+y-�d3��ϣW?Q�� x��$�� ��!Ёu�ge:�Q@��=�.�g �B�L�D7ȡ�z��@�#��܆�P��mE�d"��[�{0r7d�y{C�=)zT#�D�1g�o^��s9�nޚ7�즋Ăy�Q�$�<P��7+�>$�R|·���4��Թٓ-��s��F3��ώ�5蹜Sڶ�:T�fE)�eD ��Lڷ���RĬb�h3���69�]�G/������i��� u� @%K�����E���7a�g����~l�3�oD,1��%5�����G��J����ҍu���0��`X,�?e*�t~�Ų�0WJ�!JО=]��Cs��J�+�1�hn�`-@'�e˕��^�E*H2�j`�j�u�A/�]�C'EOF�5�q9�pG1d�t$I6F`��U�%�tk����w�6�;__�}� JR�{�� f�U����h�m5�m��E��9,r���ƍti��U�P�N?�k���V�d����k��IFj ࢿY���'G�c�?�m�>R������Z3�I ^-*���kR|,#����(Ѧ��<��Q�]���7?{�';;�˳��XK-�ц�;-&���1�r!�b��u̔���k�CK���9#i�|��[k��CV�ث���������#"�2,��j�Ⱦ�6M���>�k8���gW�������$q�p��gs�-�^4�&�|�U���W�hU���[����"������-�������vͳPE��_�d��x��2�*��6����]�Cg*��)�g (<<��#S���7�s���ﶉJ
Behavioral task
behavioral1
Sample
dd0ebf5aef54ba71f269cfa25e78e82b63b3a648d9463f214ce0409d5b5cb360.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dd0ebf5aef54ba71f269cfa25e78e82b63b3a648d9463f214ce0409d5b5cb360.exe
Resource
win10v2004-20220901-en
General
-
Target
dd0ebf5aef54ba71f269cfa25e78e82b63b3a648d9463f214ce0409d5b5cb360
-
Size
60KB
-
MD5
b3aaf051b6cbe51575dd05a0a4e130cb
-
SHA1
1072ff6a37e5d386a01cb2096a611e7434885a4a
-
SHA256
dd0ebf5aef54ba71f269cfa25e78e82b63b3a648d9463f214ce0409d5b5cb360
-
SHA512
c8802c339180045fdf5821bd26ee9223e9a16f262b54d649f33e7e384735ec53c25615813ac0a3616beea930e049397313527693781bc43fc7a2cf63b06b1548
-
SSDEEP
1536:QPyVdHjIjiriZ9+JuvyZSU3hyxQqE4yOns9TDyWRW:LRjIAixvyZrE9EjwsT10
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
dd0ebf5aef54ba71f269cfa25e78e82b63b3a648d9463f214ce0409d5b5cb360.exe windows x86
0747b167fa3ca22fbd4e9ed0d8de3a6f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.packed Size: - Virtual size: 280KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.RLPack Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
RCryptor Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xur Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ