;���d�$C��Ǧ*��W�!� �T8*��ЈxW����7ğe%����vH�����6��#�k��w�� Y��������k{��f0�� ˱۽ÒC�B�/2<u��~�z!8\AQ\U�F7>RmR!�U ^���r|qSwЗ�n���1�q�yuC4���&��&���� �^+3_�Qu��пf�������lY�Y�N���{�x�&��W(��� XH,4��g@�^��1���@���`;0]`j��ÚO�y[�0����Q��)������C���D�p���d���6O믹�e0�������T�f��4�\�^t�ew���ƵfSinQf�;]G���{"a�Q}��͙^L9��uS_i<�d&���=G=?zV�G�,�HH$A+�uLw��%'*$��N�]3�x���Cb��6d�'��0���0D�PjM�˻��8��hv"R궤�'7�p��Z�g�� �ܥ��qKH�CE�\ƸS"�w����a� M������&ٓjG5�?t���I�ׂd�I��?>zރ�P��3w*@~�(N���I��ԏWYQ������,�i��ɱ�y���O� �kjt).�t����NPW�mC�<�n��?��)��d�qȄ���[,���u�� rA�϶���տg�Nm���.c��@�Cw,q�ue�RrGìܸ|/�A�OD M_�~���Ӎʯ��É+^e_���'�A�����ac1���w?k� z�������=Fghu[���������h3�"����!��n�(v��Q3A3^x��!��Rg�С(h �I�꠶Z.���A��VH�F��%s6Ɋ�+�[:I��������ѵ�t>t]݈}�LA���G���Bl�,����N8gq����jM$�癹��A�ڠ�|���v�pu�&6<�۲�;o)����4xCs���ΐ��wfX<��#��Wm. �Ɂ�C3c?P���������#��S��˥W��w~Ω�%��!�:�l��X�.F�σ��@?[6�$��1�H�F�7Ww��K�25'�.��j|P�6�D/!>b��%)3�j��YD~�mJ��3{aV|��V�.L�ה�5�v��?aB:<����ز'I�Y�9@� v��e(����h�Ξݑ}L�����ayB(��L��oO�]fJ����7�6��2�F�s���(��P�YX���HU�k�)X�=��v�S������5�,9��7��i"�0j�P���? ��d��:<>C�T����E9F<�"� ��{�}���H��l���a*6���\�Fi�W{by�X��э�u]�i���' �%�qO������n�b�ਬ���]�\�� r�����Yp6S��M�j22��r�x@az�r��������\��Bn��lAI��`��.T]>�Gbf+��b�BA�2�>0�e�R�ձ�z@귖Z~a$�b�5���{��]y��OC;����m^��9q]rH� �Q��՜k[�D�醿��Q�Ǡ�;G���ul'��x����ei����P�RՎ���� rz���C� z���D{���M\v��;b?1p�,�#��ꚣppy���2C��\Qk�9��U�1�g��yCP1S+7x�]�gg���T�]0bDe�� �Ǥܸe��y��zM�ק�l]`7�H6�3��ި�T�?C^z�|x�;�����o��������.�W������J��`�� =�}+O�*�x�\�n����f�W85G�ڟ��z��U���_~���bH�K��4e�@��ۦ��emc�7�����mo�=�T<]$iv�e e���Us�}�h'��-�� WU�P�Y��_�����ii��@Gh!²����6���e�&�LKJ�X ��mf]�����\�/�`���O05�i����\�[h+]^'����szS�sN8��,17P��6#���u��~5���ԑk��aI4t*[�*Ij����7M*T�����y�CN���Y}�F�;o��6B��<Q>L�����X���=f�C�ĭ�XI��}24=�=w�̚��b<w���b�W*� Ļ�6�?n㷐}��L<%0�ǰ���_�����~��U�E�֝ĵ��P_��d��O�1:H��n���/�h��Vs��X��v�iiw�ԒB4����O���@��'�kݹl���(����o�T:� AG%�3-'��6x��u>��9� � �{��8d\uk(���R��Ǝv�*|�*��{�;��m��qH1bʍ��;�X�sǢ,#S�B�ږ�!oO߭9��~�o"ݎjeoНH Ѭjr! �ES�M���g�d�$�]!�<����_�ڦ煼�+��+�M��q5BpV�y��Ծ���k(� t��T���f� �o[�v�6�:YXÃS1����Ƥy�[���j�n��{�[��7�~;!�)NXV�M�)��w��W�U�7���U��*#*��(6�:���Y+ ����i�&Z����),c�Q䭭��*��3����R�FZ����&J���O^uCE֗���߁1�^ Foˆ�_�L��R]Q&Q/~��#s�@�+6����B��`�3Tk��+�lqZ���L;�a��g��.�߾�]_Ș���#���- K��F ���$kYb��f�bSL��v�`l����S �����ƚ��=��W�y�+L��z��������9{i˅*�<�b����ϲ��0,$1{|Y== �F�Q���&ּ�ǣ�7�����wA>#���=�ji��]0��L��5os���p�'֢`��E�ɶ�~�l��X�Hq���:D���Ht��i�!�Xi�ůS7n,�:N/m^ q��^��z9n�Q�@mwb��5�\p�rOa!�;��@4��}_��C�#Q����Ő0��%#,}ݑ?U�f�<-�[�8>�G���.�Z��]#+[� (p�|;���g;H�;�tUz�D�ԥ�1�=�Q�WWJ| ��yk4��d*8c?(��u��9<K ��/Y�y���.��Dl(!bR%��G�c���f�%�Ɍ~��A���y�\s:�ȇ��X�X��/� Er�
Behavioral task
behavioral1
Sample
2525345b1a981bcca6f5b44b17677ad706fb7255e82e2a59372bd03db283d47d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2525345b1a981bcca6f5b44b17677ad706fb7255e82e2a59372bd03db283d47d.exe
Resource
win10v2004-20221111-en
General
-
Target
2525345b1a981bcca6f5b44b17677ad706fb7255e82e2a59372bd03db283d47d
-
Size
232KB
-
MD5
a689d06b92ef107eabfd87fff848e62d
-
SHA1
24af537832657a09a561a079e81b32fac983071f
-
SHA256
2525345b1a981bcca6f5b44b17677ad706fb7255e82e2a59372bd03db283d47d
-
SHA512
0df28d92cea766dbdc262225b3c0976544f49eec45e5f25718ff5a1c494eb54d50d6e6d5c13cef721fc9bd6d4931e962253d3809e35135a1505dbcf60a4a9756
-
SSDEEP
6144:hvm9E/QVEuCd7GKLWzDE3FkVGxgo2oEJ:hvOyQVEv7GUWzQ3FGGxgo2o
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
2525345b1a981bcca6f5b44b17677ad706fb7255e82e2a59372bd03db283d47d.exe windows x86
3433bc69407b8417869b0bc6054c24de
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RtlUnwind
RaiseException
ExitProcess
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualAlloc
GetFileType
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
VirtualProtect
HeapAlloc
HeapFree
SetErrorMode
GetTickCount
FileTimeToLocalFileTime
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
DeleteFileA
FileTimeToSystemTime
GetThreadLocale
InterlockedIncrement
GetFullPathNameA
GetFileTime
GetFileAttributesA
FormatMessageA
LocalFree
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
WritePrivateProfileStringA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
MulDiv
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
LoadLibraryA
SetLastError
lstrcmpW
GetModuleHandleA
GetProcAddress
GetVersionExA
GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersion
CompareStringA
InterlockedExchange
MultiByteToWideChar
CompareStringW
lstrlenA
TerminateThread
WriteFile
SizeofResource
LoadResource
FindResourceA
LockResource
WideCharToMultiByte
CreateThread
DeviceIoControl
TerminateProcess
CreateFileA
Sleep
GetLastError
OpenProcess
GetCurrentDirectoryA
SetHandleCount
CloseHandle
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
UnregisterClassA
RegisterClipboardFormatA
PostThreadMessageA
InvalidateRgn
SetRect
CopyAcceleratorTableA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
DestroyMenu
GetWindowThreadProcessId
GetMessageA
TranslateMessage
ValidateRect
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
GetCursorPos
ReleaseCapture
SetCursor
LoadCursorA
SetCapture
ClientToScreen
IsRectEmpty
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
EnableWindow
GetForegroundWindow
GetWindowLongA
SetWindowLongA
SetLayeredWindowAttributes
GetKeyState
SetForegroundWindow
IsWindowVisible
GetMenu
PostMessageA
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
EqualRect
MessageBeep
GetNextDlgGroupItem
CopyRect
GetSysColorBrush
CharNextA
LoadIconA
FindWindowA
GetSystemMenu
AppendMenuA
IsIconic
SendMessageA
GetSystemMetrics
GetClientRect
DrawIcon
KillTimer
SetTimer
CharUpperA
AdjustWindowRectEx
IsWindow
UpdateWindow
InvalidateRect
GetParent
IsChild
GetFocus
GetDlgCtrlID
GetWindow
GetWindowRect
GetWindowPlacement
SystemParametersInfoA
IntersectRect
OffsetRect
SetWindowPos
CallWindowProcA
DefWindowProcA
PtInRect
MessageBoxA
gdi32
GetStockObject
GetDeviceCaps
GetRgnBox
GetBkColor
GetTextColor
GetMapMode
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
GetWindowExtEx
CreateRectRgnIndirect
GetViewportExtEx
DeleteObject
SetMapMode
RestoreDC
SaveDC
ExtTextOutA
CreateBitmap
GetObjectA
SetBkColor
SetTextColor
GetClipBox
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegSetValueExA
OpenSCManagerA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
DeleteService
ControlService
StartServiceA
OpenServiceA
CloseServiceHandle
CreateServiceA
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA
oledlg
ord8
ole32
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoRevokeClassObject
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemAlloc
oleaut32
SysAllocStringLen
SysFreeString
VariantInit
VariantClear
SysAllocString
VariantChangeType
SysStringLen
SysAllocStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
VariantCopy
OleCreateFontIndirect
Exports
Exports
Sections
.text Size: - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 204KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ