(���J��H5#O$" �{D!,q�wݟ.&�y�I�d�A0Rg_��M�]#���t������~��9�J�-��`"�����#����r����Ci3���r��<�I�QÞɺ�' ϕe�{"�`����~���:����>��iBղ�r;v��x!��T����l��/k��b�C@^����_�h�\�,����z<|�CX�{ C�Ć������QX���#�BX�u����~mH�99T��K*�����/��E������͘����DѰ-0�:s��/Ss1u#�4�����f�F���1e1�{I�h a=�Sh�7����{��ɕܣv�����c�#�H��ܿ ��Hݑ�b���м��7�m����3�:XY��A�����)�ñ�{�2����9g64��Ey�H�q��U�I= ����#�nP(����/+������'3XNF�Ǖ/��s��0��h�燗���]����JU�U0Tlӛ/�]ʹ>�:]ACROA���=p��Gd�p��[w?�<Dl8�����th�b��0xShN ,�Љ0Ĵ�ܛG���t�` ��=Z<���B����W7��n���}]�0�(��gi������n\7x�ܼ ���eflij4�岡��31�ȸ�+$��&Y������� �Æ�1N(��Zļ�gR��9"�ܷj�Z���:��LjW?���~����r�UQ���Ad��nM�^�G& ���������;s�7�QS2�k}&'&�%��'�_^-M�������H�F�\�^j��K`(�BM��|�������V����J��d[m����yh8Ē�p� a����ځ����P���C�=����C5SQ��J�DdRX!�y����>�v�3u,ͅ����Y�.X�TǮ�$������X�ޮ:��b�ͬ���#q6�sU��7�ĕ`�D��Ƃ���)��/���M� �7%�@a�K�e�t���h�;�ܙ=�ZĄ)m�e$_4y�5V؎h�^=�~R�O �S���*�>z受�yB1x�0L�JX�hJq>/��s�Qg�t��<0w�ݤT�:ԧ���'=�s��،YJiM������U�Bf)r`�����iI#��Q��x\=����`v$V�����������y8�߳��]{X�����S��&yb0��D��kTߙr0 (��̖|h��+���9��a!#ԞP��We@��L��� ?j~�]}`kkKZ��GÎ#�x.1�'�Ks�%�>�^"�I��g��2��0�H���s>L����լ�ۂ�M�20&�]=\�L]��ֻ��>\�)8o��/�4�X���W��l��np T,�l�MY������}#$ٚ�{�w�WJ��y��/Qˏ�K�S]�- O���!�ɼU��e�z8���b5k������Z�����F��o��8�@�C)��B`�=]�3?���\Y %�^���g��'K3�/��h�� Q����.o7�U\��7��Э��bO\[rqw{��˸aX������L�3�5C��*- �$Kǚ0Z����CX����E�7)��C����Z@�tL�Y���� ��.0b����D�u/�0�[�O���t�C�i�Iw�FF���-9� �m�C�B���k�lt��'��ޟ��ה.L 1���G�u�O�3X1���D�T(��Ϝ�*܁��KlvI�{V����4 ��He=�����UT�����k�$I��H�� 3?-��+��'�xJtX��z�ѷ��>��ܜc����� ���D��|�|\ �M���)x��F7�j?Un`�����9�ì-�O�X1s�$r����ׇ����^�QO&��^!��ރ�u*}����ʰ�v�=��/���0�N^�eB3���I�v[���� �Y�y���AkW��/� %K%{�4d�S�� �M= ���qd��ͷl���-)(�9��Ϥ�v��t'�wH��"}Ma�RQei�&B�ﵷ`=�_�p�=��g8����������>Ɨ��A��_�cs ���v��0 �����������d���ϛ=b���)�� ��x���d��ٿ����~F��I|�5����Y�����Ei�)$a~o�kh�&QW�� �R�(�?�x��L7x�"Y������x�� �uO��'��UZ���S����I&�ğoݾ��r�(��cwH|�� a�j����ufv��-|�q4�^{}���+������V���?bFI��J[���O���2��3�y~��בK��?3����|��.r�m��ֿ� 蕤�=\}��z�J��9�$R��7�TP��ć)>�ظ���G�i�����D�%=�l����R����9�5�{�N�������إ]z�ɛ�: :��6�������������5hsǎi��I)���<o���T��+,L���'�dT��w�I!bܠ�º��^���<+�R+��S�J���-�U}31;��˖�b�pP�H�5����)�߾���I�7^�nW�ZD1�I���T⚖ N�#���%�Ƹ�YI�M+ǠT�Ŕi���6=j�=C{�-5���] �e�vV+��z����8�-��� �V�� ���#B�k�}�(����(�pе�������qI��ة�Fu�oe�g �+������[� �\m�խ709�T��Kj�#�0� �>�:�-��o6Dg�N�����t� ),�LZ�"i��L�faBM�ڒa�[:~yM���O/Ii���5=:���)�2c����\�Ȕ\,ɰ�&�4x�Uo�i��a����)r�g���;c������m�-�B1��aR���Q� 3¼��=�c&��~�W%����o\&��#IJ�L �z�8�$�@Q��賘�{a�wa��g��`�D�307���p��Ѯ���;5q�����jQ�� ?��c�{���l��N�H�����h��J&�x`[�<���r��G�;1/����g��h�}n�jQZ�C�g�qr_��w�i��ٚ�q��0�uxl樳PdD-U��&���7F�E*��G�e�w�4B,��#�/��6��M�be���
Behavioral task
behavioral1
Sample
bf625b7eb2dec689cad2b907729f1b9203c47987ce0980303b2f94ec59d2f425.exe
Resource
win7-20220901-en
General
-
Target
bf625b7eb2dec689cad2b907729f1b9203c47987ce0980303b2f94ec59d2f425
-
Size
1.5MB
-
MD5
46de5f9b559ab8cbe68d41e81598562a
-
SHA1
a0baa3e51f4cd818e650138795d78349ec541e0b
-
SHA256
bf625b7eb2dec689cad2b907729f1b9203c47987ce0980303b2f94ec59d2f425
-
SHA512
6e8566dd8c5afbb5dd06c0ce4a93e0692d5a646735cc24e8f0a2a4ca6507918f28a31b32abe37e440d7eea52447aa9bf449d9d61ccfdd7fb7e4fdefde6f5f8a0
-
SSDEEP
24576:FUk/gksq2PbAQl0kjAdrdKrUOfqBza0Oa7+zaVNC7GG37dj2ZsjNESWbEz:FUk/guipjAdrdKrUAqwhaiWwGG9msjNj
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
bf625b7eb2dec689cad2b907729f1b9203c47987ce0980303b2f94ec59d2f425.exe windows x86
e5e263a191fbcd90d90965a32300addc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutWrite
ws2_32
accept
kernel32
GetVersionExA
GetVersion
SetFilePointer
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMessageTime
gdi32
RestoreDC
winspool.drv
ClosePrinter
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
UnRegisterTypeLi
comctl32
ord17
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 508KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 403KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 839KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ