�5t�=��h�a���O���|)d���f�Gb_*I��}�Z!��)N=��56!<�>���CyB�ލ���R�߿��;,��$ۿG�:�����fhdi�j�B��]p 8��D">K��ؿ�M��"�l���\�-ߚ��|0Mǣ�����V���j��>'�(��&�O�'+i���}�.�=0X%|0�p�(h�KS�����a:�t�x;Noۄ�~8�Z2<�!����>��^��ؑ���m�����:�8�H�k���QIA-��Rvo}��lv*����M �i�� ��G�Mva_��)��Ź��]P�Z���k���M%S{B�-i��y�M���a�����po���^G���*e�Z@�f�%l�a�MAeH����7������w�6af8�3��0T�y���{�Cԡo�������t��3��*J�4��r�߷T%:#J4g���Y�W���4.N�i<��҉TT$*vׅ�i�pY��8��x�C����Mv/<?�^*���{wtPc�O&�Y� m��9��y� Rt����7 �x�Z���D�� ���O��FY��u�%Q��ѽ;���$�fAB&I1,t�,��ᑡ(���(���!6�Y�?O���" ,��^�=���v\���5��F�րkq� ��V�BS,�Y���t��T ֺ(�l�߆rmՁѠG ��µ`"��alV�=Yp�n���2��=�F:@G�gw�錗��/n7������T?S?&P�a����gh���vſS���#-X:���A�\/��=4��A�.�w�k�PᗬG7i��"R�R��<��ר�2�����4�B������/Q�5l�X��(J�b���$�d�?��Z<riA/`��t��C �/�i�݆:�[��g�un�E��krnxk%t�C��6A�'�Fa��|&�xSˋ"�,�?��z|�I��voY�z�z��m�<�tz+��e'o��k�;cK�[ ���j����b����Z��Mڤ��ӭҟNF��ꮯ���&�ڲ�M�ì�4E��#�٬��^��Ŷ&I P��og�o�����OHjP�9��L�/$F6��|����P����(5"������e��0<�m�\kI����xcX\���g�s���tm�� [��4n�R �@�K�dݧ�ǢS��u�\�Il;�]\��d���IC��ʼ��O�YA��m�����\\G�l� =m�'ɀ"�J�y#�;=���KU� ���ȩյT^a�PB�'�6�����N�����,�5�F�^��j(��* &q�m���xlz����Gָ�&x(��]; &/�U��3�.��9f�8��*�`vJ�`9N�.�~�~���QJ�E�l� ��FXGEt�M1ˍ1�*����PP&Χ"�6�2�������ߚ��gI@�6�C�N�M�wi�R$ψ>�dU�t~#m�?ٸ��6������%��N&�ĕQ�r�3>̊(�������"��iPD;m�+�Ax��u�� 6+Kz��R��������˼����x���߅+N$���_���r�Pd �'r�#05�i)�7p���m�Gb�Z�-����i�4��݂"Ӱс=$�A� L�)=zp� "0�o2`g���$��Q*��P��B��h��zr_>��q��M�>@2rS��T3���b��i4�����sr�-0���ݓ,Pt�mr^�i��oXu"�M��$��ˋc 9�|��ldaݪ���������������$(���1�G��OP?��{�yړ��c/���D��F��1�]����=R)ԩ��J��&(�q1�!�:�CX�,��A��L./��͙ ��:�o}t�d�l������ȍ��]^kn��S�X2@���F�e73��e�`;(|ǙOUC����/t3W�c�����h��Ĉ�w$3�D�DA��k��DI��Ii!�t�Y�#�c��SM4�n�[�6��wk��e�Kl\X?V>hQ�c[��ʄ�i~|����ۑ�?������96ӌ̫��Xc�o��l�0��lp`��"�9{<��8����[����D��B#"�F���}��-���VO*i���^?'�W��rH¦;����D��c��������o�l��ޏ���� ��)éV��)@��� ���i�N$�ñ�}�*@p�k a�2�ŭܯﰃ��K!Bb�Oe8�rCk�\�4�dwQ�c�=� �1�����q�Z�6��M� ?�u�8�/�.���������E������2(^v1�K��n �~B�-3����A9���ut(�U�{}�JF���=�%�K0CZ>r�i���w�QX�X��(��!���KF���f�A�%P0i���Ό��ڭ����C�,,��T<fp �fM���~p:�21�b#dEx�G� ϱo�W��x$>=��$;�y��$2\�æ�VQz���2ef�Zt�'Mn����ԅ!Y������u)��K��6�������h(~\����u��l��F���ne#L�&*z4���P|fG�'�h��K���:��� �i�2�$�/S�+ e�UHH��[?C�)U�UW����`���{�p�K��ī`e���;/�<���ډt����<�c�v��,%p��FJ�8��1����i�XQ����d��%�_�����Yf{��# `=���.�g{��{(r��*�óY�%J���'���m�Sʖ��_��H�O�Բ��?�MV/Y�, ^Š�C/��BN7Ū���M�B���C{��;��@�"�ʕaD�ÆG,װ�e��>W��~���]����}(��rdO���d��yX��K�?��V��: �`� ����Z6#�����qQ��;;�WAP��%op+ ���+S������y5�������FMO���'�g��mGS�Nf�[�.[pn���z�n�&UX ��s�|��������x�F�>\�ȫ�Y��y���<'�.>��{j���?p���N����- g�B�A�X7�,sA˽ڻ�~�]F p�k�j�H��[(j��q�����u 1ik�V�-~r�6�-)��_��n��u���U1zX�����@���H
Behavioral task
behavioral1
Sample
d34ea0d6811a9b616fe870bc48f2e7370d47f14af998b29ccd0a83625b8d508a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d34ea0d6811a9b616fe870bc48f2e7370d47f14af998b29ccd0a83625b8d508a.exe
Resource
win10v2004-20220812-en
General
-
Target
d34ea0d6811a9b616fe870bc48f2e7370d47f14af998b29ccd0a83625b8d508a
-
Size
316KB
-
MD5
fe594ca5d2d7566d555c3d665c72be47
-
SHA1
5af1a367e9b5d86492e26aad382e8ee4e12135eb
-
SHA256
d34ea0d6811a9b616fe870bc48f2e7370d47f14af998b29ccd0a83625b8d508a
-
SHA512
572acf1954c8c95e65f3ad5acd528c7d1d9c6037c7588a2f196855b9ed8d18fb9fbe20dfd5b364842d478cac282daef31f9ad09e6091703661335ac7312bfcd5
-
SSDEEP
6144:5GWViCouCsGNSBc2XsLLHh7XBR5OYB8cfBV+4zHVl/jEmERxZXQGlOgjSG4C:BE8mCsLGcf7VmRxqGlbS0
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
d34ea0d6811a9b616fe870bc48f2e7370d47f14af998b29ccd0a83625b8d508a.exe windows x86
fbec2def0a3fa8d5aef987e194150553
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaLateIdCall
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord626
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
ord667
__vbaAryDestruct
__vbaExitProc
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
__vbaBoolVarNull
_CIsin
__vbaErase
__vbaVarZero
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaStrCmp
__vbaPutOwner3
__vbaVarTstEq
DllFunctionCall
_adj_fpatan
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
__vbaFPException
__vbaInStrVar
__vbaVarCat
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaVarLateMemCallLdRf
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaI4Var
__vbaVarDup
__vbaStrToAnsi
__vbaVarCopy
__vbaVarLateMemCallLd
ord616
_CIatan
ord618
__vbaStrMove
__vbaForEachVar
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 119KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 407KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 300KB - Virtual size: 296KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ