}����6o��RG�1��N��:h�=_��@��v�ʬs"���:0I�?Ȋ���.�WR�|i���q�����s�3<�d���%п��. +.3�m�H]���w�uCo�)���b�uA���n�#�&��V���I�G�u��^&:��p<ӭ��9�����_4����0fQE� 됽����p8hYA�2Q%?g_�v�W[� ����X�>�g/9�5�����x�nU��+w#A;�,�hWltl�E�f���9叹�����@���wEI�y�t#�6ܩĎ�͙Ck6I��<S�k@��ZMa�i�Y�(W� 8Q�&�)x��#^� #�l���yƭ���Y}c��_h��~pQ���?>�������Y�A�Oc@~O�P����� ��|�?I�H$��t�}_89�d��#ޒp��Ǘ�9�*i�C&9�-3��ĝ��zj?1��xx��`�U,ˈ:�2���ϵ�p�Q;�L/@}`E��U�TJbbz6R�UD��yH�O�U�$�O��ekx����n����m�2o"�V_J,/ۅ�.f����,�A0�?��ũ�R����c آ��cAwF �ǹ�E��瘇�%n@�O��{��L�L;��rS 3�A�M��K��¢�ʭR��B�q����$�|���t�)�6��-e��O:�5��`~_�65��u�f��,��r m�HW�EY?☁Y�{�E��ul^��������������قՓ��l��PuXc�O�߹#���M`M�G;w!CI[�s�1� +vђu7����p��!��z�{[]�j��,,�Ѯ����Y8fU�0�V��ܥ�4�?���uRE���p�,��g}t00i�ё� ������D4sg�U�y��cOxh���v�GGcs�ݐ�{�jP�b�?�#���ˤ�=��[�؉ގ�F[�l�Yk�=�.�_IT�'�q�#ȧ����TJŊ��|x�Z�̥B�������[���6Ėhq��I�_U�S�̸�³_��{q��|���ڢ �>ۑ^)�O����d����ѩ�$< m���%;�*,t��4_u̧l��4���[����YwBf����}��[��o�{��zY||���}�F�)�/P�s*�I�����Ղ(��z��lC�@ _��D,E���ͮ�C�N`��쨈��,�+����6�\�M��A+��;�zrCA���I�� �A`a�R$)2J�� �>R�&�ݬ��H��n�`�3�%@�{�շɸ ������{ ���n�T+C�<�$�ɉ��~���#�vM�N���X��`��%螒od�M���0I��Ybpp �u�����b�z��zsa$96=��x��0�Ej�6$�sf�Gj��з�D���$#�o��̤�ў��C�� �ڹR]9Ȳ�jq��e�ڜp�����LV��\v��G���̉�TQ<���KNpaV�D>ALvU�a�.E�2�&D8����"�;�#��"�So�V�y���-Eu{��?/&lw���"SO#��3��y�qSi���F��8�p#��4{}�/1u��?����'WM���q�6���f�e�p��+U%���0�FU���f� r����,!����i�<i�B?x<�5�%����֔u�O�ww]�G�� ��b�@����t��䖐f�o�Z� �/�)z쳇0�:���i�� bU�H̛e�o�����*;*��32�mR>�e(U�v�� s���"G�ah��h�����rH��t�fÏ�k�./|�9[R*f���bǘ�kS������}~��� .X��v�4��~�7���6,fH�s*kG��H���W����:���Y��WO����"�q|�E�e�����`$�����(E�p<��q�Hn���\t後���\O�CØ+��De�.YG�5�� nR��X$��,ɫq�E����� ������T~�y����k5u��7�ZM���mw�>����+��K�Z���E�f�;���, �n�����'&��{7V��U��y�b��¼�f�n�?m�eD*��`�Z���躟^z��������᷿���n�}le7N�V�;�}�'�[�5ա����J�XspD˅a�����kK�ӧ@4�+���8?����[`���iw?���d5D ���4��"��KBpv������T�A�T�|-����� �����.��S��/c�=d�'+E�X�7^�*k�}�ܾ���~'�����B(o��)��g�o�ޡwx'��r�� �&��t�P) ��A+:ٞ�����P�HO@�(������'iw���t�_I��@ʉ� ���@�����= g7����yLR��ŕ�ڲ���³�/�Y�(��i��D_$]����ln�Ks6Fiý�Z��OI�g3 +���D�тE�h�����+I���u�gY.��if4� � .YoBy.�� �'ڈ���$�z��'"��)'�Q���rB2 �v���6�а{�U� ���L��F�Q�zZ^���3�e�f��PWtN�:��d�d8 ��Ҟ�p8T��e�.�"����Wwt��N�Z�Ɗ]�g�P*ѕ�g1�{�?�'_k$U)�*G��g-:i����ZؿF�`J3d�3��F ����`�>?62<u�p��F/�u%.p�m��$ޣ��ۚ%�V-��M*�f��-&>h�K}�l^ `A�:+�;����J4U;���"t�څ�q���l�ͳ��8: 1�Tz0n?��n�c�M�O}z�)����C9hA�l��s��7��4�з�DW����V�{9��5�H�_H#2�+��I��|�>;����AN&I�D#��c!U �����P�L�~��.O7=�@2��(�9�q|3� ❔�<i�n�����������+<|��k�{�O�M:�Փ|��Ǝp�'����M��o�TI�Ho��R�Q��7�iѲx!rѲ�qqrz@��;��JBQ��3�&�g&}�d@���*���l�>?Z�$��O)�ܘ����١�Z_��T�T���1f���:�,Ģ��f�����%�0�}f�ͽZ���ed@��{sI7�,��
Behavioral task
behavioral1
Sample
928e11635dcae6ef9a3180cbf435885765885040e9e3f9e03a90d9b2cbb35503.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
928e11635dcae6ef9a3180cbf435885765885040e9e3f9e03a90d9b2cbb35503.exe
Resource
win10v2004-20220812-en
General
-
Target
928e11635dcae6ef9a3180cbf435885765885040e9e3f9e03a90d9b2cbb35503
-
Size
208KB
-
MD5
037f391b232c051b66ea7ee0efc634eb
-
SHA1
2b7c97c6d81352b4adbbe69e8bffce28c29d8e23
-
SHA256
928e11635dcae6ef9a3180cbf435885765885040e9e3f9e03a90d9b2cbb35503
-
SHA512
d9b403425aeb42b56c78b75af208e34e6cde0f1c5f9206344383d4263de29a65f75fa7c48df22ec90da0891e89b85f3efc9466318077c76e60d2b15e337c6405
-
SSDEEP
3072:G7gx46ZBd0gkuhrMJlGj9ALipQAZvzQMrHN8EpCHUgaWla5yr9aJltZrpRwC:QguUJsS9hrZbQQ8EpCHUNMTgthp
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
928e11635dcae6ef9a3180cbf435885765885040e9e3f9e03a90d9b2cbb35503.exe windows x86
32f978a474e29026426e2f8d0a759829
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
PrintDlgExW
shell32
DragAcceptFiles
winspool.drv
OpenPrinterW
comctl32
CreateStatusWindowW
msvcrt
__set_app_type
advapi32
RegSetValueExW
kernel32
CompareStringW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
GetTextExtentPoint32W
user32
MoveWindow
Exports
Exports
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 143KB - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ