�-�w���� �kf^{������IMF�!b���}�d+G��-]�����/`�?�ߐ��+�%�"k���?��ST����?���Y���+�6�S�m�3���v@2l�!M��e�e�뫯ޏO��%[�8�!f�^�fe�Ę��5�R��U��1��S�Xhc�)I��}�� e����Ur´��ռ�ݮ��*}�?$�o��x~�*7���N~�-��Z������ͨ7��Y���%'�й�b6r�顠&Sy"?w|-S�ĝ����Βա����A������K��&��WN?� vxKg�A��%��a�u0g:������|�-r٤XG��z���l �����u�u�,���U��E�tV����[�������wiz��-����o�����ɲ�<t��Q��W+2a�H��K�-��6��vY�@��������=B"���^�3ʿ�� Rb��-��c`S�be�x��^r�����X���qݕ��ۂSa�9�ċί-�$[]R�[�{��^����YߧQr�_ ���E�.Se�j,��=����h١$05��i�e�^���D�8��|K�kL�Սy�OL�L��S��m��V���ReBT��5�P�oO�U����};���(�o�r�#��9~���R�>eʅ[��TF�Sq�ȷ���bS\��d�����HЄ�ܩ�zE�U����yπ�Q���V.�3��cnO)A�xB���T*#s�{��h����|�*�����ly��6����������'LL9�j���$���f���L�^ �^N6<�������{�"E���܋nC����+w����5��<�RW��t7WNE|aV��?�Q����_� _�e���;��S��wB�P��kzN��/WY�H-B��=Yi�k�;%Ա��hjs�G,F%��P��E�5�����ő-�8n��sp@m7s=W~��)�}@.���p��d$#�bKxt���e��)�zԹm2Ey�?��%ᔆ��DS�Z��x2��7�K��P����34�|}�?��*�"�+�R._G[�]����R�x�pFJ�A�h��y�!`U�w�:_�ذ C;NCy%����7�@d/����Ֆ9�Z� ��N�� <�����c��J�⥵U%�:wf\��7�JK�vsq^���\�j�F�E��˒�;�G�l<#��=���pu�a�!pT���7�x�'J:UD^f��Q%$�̭C�x�"�kI��Ҕ��@�uNk. �Ps:����i�E�A�p�9̬��I.zv3^RHK��X�ui4��"V�X��F%�;���A�R�gg�5�o`��A�1r����&���j�W�ƃ��|����^P�>����;����6-i���>sPRI��B�ى|��Z~�����-��!I,xέ���уap59��L�Z����|�0�g� ˀ�0��h�M۬UH�μ��A8ӟH�1����N8�����.�!�·���n�2�����3}���r�����������������N��j���xD� {�گX��ڞ�#���1:�ѹ�Z 4R��A�����9n��AW��/3y��!��U�[&����8�x�k��V����%ɲ�g�W�j��s�+{�B���5O��R�?�?�_ЖW��It<h��8�'�pC3��D�N�0zT��E��N�+�A�r}�Q�yݖE�E8I�y�͔,F�L��N�Kf��@Ӆ�n]�=����vb�c�K�� j1{{`�n*[�>U���Qkf M ��_�7����!Cm�1�n���� v�^���<�u���o%�t�����[�#k檣�*����-��ǖd��Sv٩ly�V!�L��l�1��S����O��u]-#���� �H`�*R�5��M��@BN����>pz���J�f��D��ή����j��HeÌů� I�3YA�hW���un�zf��s��X���P�Ǧ��*�#5Uc���,o8��.R����-�+�V_��ؼ�j���"�.���#-̀H��G%�*`x%(DZGu�{+��D!�6I��x( ^e���m���%#�6�? �5�d�Q;��M�&����w*P��<����c�JH氓;���h���>��~Zk�Ψ��g���������C��u.7�O[p4�0��(!��c"M��Z����;E���PS?�m�L�_���.���d�~:��iF�����t��I����qE��D�v���C04x��"3��YDy�)�o��F�$���ul �[%��^��p,�L���}�Ih�����g���K�'��Pl�}+9�/�@?��-DOϗ=kR����q}�c��i&?�Z9���^'څ #=��2i��e����(nM��^7[����u3p?8U���mJ��@n��Rop��wDŽ��3s�*�s�(��������s������AK����܈k�_�x� n����~���]2���\�����Ū !�D�]UL���5���2i�d�#�w=�)����i���o �:֚�k*,z���U��~�� ��D�O����[_��: g[�4K�K�B&���a�@���Vo�_1�T0�Yeh����ԏoG���#n�=�Zy�݃�0Jt�ye��ܺS'��v���C8��7�q+�'���_�T�5�v�]���[+UdHڬo��A?gY�E|�����y�[�(���g���*܋D��H05^�z2N���Vw½����u�����5����5�8��R����q�34��~n�����Rޱk��e�Y�z�����㽹�R�T�9��]���0�|>�=7#u��x2�.������t'P��������+�s�^��a$f&ba��㸸H����F/Wt�r&*u�8�J�_V�lKh=����zA�ܺ���6j��X8�~�Cf+�+zϮ�6"?��xt��c�D���b��1�ū1��0���$2�4���W��Qu��y1z��������^��E��TJ|���~������3��g���7��4�Z��D`?�����u�^!�:�����ST��z�m��)"�B�5xr���ZD�f��@̦d��q?s}����흽;�@qW��"#l� �|z ��_������-�
Behavioral task
behavioral1
Sample
9912f866642d3a9bdcb19bea9394813bd8757f4977be978f5da9fa827902bfe2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9912f866642d3a9bdcb19bea9394813bd8757f4977be978f5da9fa827902bfe2.exe
Resource
win10v2004-20221111-en
General
-
Target
9912f866642d3a9bdcb19bea9394813bd8757f4977be978f5da9fa827902bfe2
-
Size
260KB
-
MD5
c0aa5b0ce4dfcc894308f288a233c127
-
SHA1
783a99aa046f91529a851c060a5ae42b5d24781e
-
SHA256
9912f866642d3a9bdcb19bea9394813bd8757f4977be978f5da9fa827902bfe2
-
SHA512
00a979fc9eeef4543cedf95056886459f493e837ea4fbb180e254321658aa41b369af6a7c03f3065f2e33020aa742950224a5cc99fd9c34564a972da625ecc5d
-
SSDEEP
6144:ALRF/qJSWIjlhWkHKi/Pxk5Gx06ErRCChVpOmc2a:ALR4JRuWkqIGWDqRrhVtR
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9912f866642d3a9bdcb19bea9394813bd8757f4977be978f5da9fa827902bfe2.exe windows x86
7b7eed3c58c2ba94b497ec0dfc1d1561
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlUnwind
RaiseException
ExitProcess
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualAlloc
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
VirtualProtect
HeapAlloc
HeapFree
SetErrorMode
GetTickCount
FileTimeToLocalFileTime
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
DeleteFileA
FileTimeToSystemTime
GetThreadLocale
InterlockedIncrement
GetFullPathNameA
GetFileTime
GetFileAttributesA
FormatMessageA
LocalFree
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
WritePrivateProfileStringA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
MulDiv
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
LoadLibraryA
SetLastError
lstrcmpW
GetModuleHandleA
GetProcAddress
GetVersionExA
GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersion
CompareStringA
InterlockedExchange
MultiByteToWideChar
CompareStringW
lstrlenA
TerminateThread
LockResource
WideCharToMultiByte
WriteFile
SizeofResource
LoadResource
FindResourceA
CreateThread
DeviceIoControl
TerminateProcess
CreateFileA
Sleep
GetLastError
OpenProcess
GetCurrentDirectoryA
SetHandleCount
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
UnregisterClassA
RegisterClipboardFormatA
PostThreadMessageA
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
BringWindowToTop
SetMenu
TranslateAcceleratorA
InvalidateRgn
SetRect
CopyAcceleratorTableA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
GetMenuItemInfoA
InflateRect
GetWindowThreadProcessId
ShowOwnedPopups
GetMessageA
TranslateMessage
ValidateRect
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
GetCursorPos
ReleaseCapture
SetCursor
LoadCursorA
SetCapture
ClientToScreen
FillRect
IsRectEmpty
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
EnableWindow
GetForegroundWindow
GetWindowLongA
SetWindowLongA
SetLayeredWindowAttributes
TrackPopupMenu
GetKeyState
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetMenu
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
ScreenToClient
EqualRect
MessageBeep
GetNextDlgGroupItem
DeferWindowPos
CopyRect
GetSysColorBrush
CharNextA
UnpackDDElParam
ReuseDDElParam
SetWindowRgn
LoadMenuA
LoadIconA
FindWindowA
GetSystemMenu
AppendMenuA
IsIconic
SendMessageA
GetSystemMetrics
GetClientRect
DrawIcon
KillTimer
SetTimer
CharUpperA
AdjustWindowRectEx
IsWindow
UpdateWindow
InvalidateRect
GetParent
IsChild
GetFocus
GetDlgCtrlID
GetWindow
GetWindowRect
GetWindowPlacement
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowPos
CallWindowProcA
DefWindowProcA
PtInRect
SetScrollInfo
GetScrollInfo
MessageBoxA
gdi32
GetStockObject
GetDeviceCaps
CreateSolidBrush
CreatePatternBrush
GetRgnBox
CreateCompatibleBitmap
GetBkColor
GetTextColor
GetMapMode
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
GetWindowExtEx
PtVisible
CreateRectRgnIndirect
GetViewportExtEx
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
GetTextExtentPoint32A
ExtTextOutA
BitBlt
CreateCompatibleDC
CreateFontIndirectA
Ellipse
LPtoDP
CreateEllipticRgn
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
GetPixel
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
OpenSCManagerA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
DeleteService
ControlService
StartServiceA
OpenServiceA
CloseServiceHandle
CreateServiceA
shell32
DragQueryFileA
DragFinish
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA
oledlg
ord8
ole32
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoRevokeClassObject
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemAlloc
oleaut32
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
SysAllocString
VariantChangeType
SysStringLen
SysAllocStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantCopy
OleCreateFontIndirect
Exports
Exports
Sections
.text Size: - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 232KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ