�s��R(�=X��J�����Z{�1:�Ƥ�^�P��U\�9�N�u��J�<�ՙ�z0`���eܚ ��)4�����k����b������cFp��^�(�0tϊ������vj:�; :�/D2������f>C�Ӕ�%�����(�G�VS����ǜs�X\r�3 �2/�]J�B�t���O<�b���Rk�`'ɯό���v��\�����a��o�uK�tF����X���Ksx�\Zj�%�`����GI+��;��WnM��$��ʻ �s�r1t�۱l���e&�>�!�-`�]xc3.���Fqv3���&y���U�eqM/d�Hc�(ĸk<�����A�Y6XW3hQ0V��b���j���l� �wpV�p\P�[U��܆��52f*�}ۗ��2TOVXuq��P��);L�8�$w�]/� J.�(7 BP.$��ȓ�O{�'|�|��!%_ >�jۦ��{P���4����o�P���|�+��� ����'F�=#h���P����RV��/�C}r~�`h�c��o��.���⏠y�=���|��/���ǎ�����4&rAr�"��y\�̒ G���< t�M����de��Q�{rH0�IHE63�Dy�R�Gk��%�Rɲ�t�TV�ӛ���(E�j*������t�<��!>]�]I��&�X�@�Y0�d�Rӓ�ל��)��y���֬�E�E:�G(���}�ſ���[�J�|�u$�"t"ɶA��z�(wag�U�0�-h��7FvD�ڹ���7l��ƿ�rn������vr �Wd���Z�@6�$hp�"�cD�I�O\���,q��<�ےI���TH��@���|Au0]�Z�6��ܮ}e{����![�0sN;5>��塢]��%p�Ԓ���q=]â��P����E�c����CM{�ߎ��!Dต>Kl ����A�rz�ÿ��%_t�(�,D[��]*����2p�$��r�eh�L��� N�@�M�]�zz��I�(5�<���ժ�K�x��#� �E,����:��]h̟DЪc�G��o��j�=�h֗K�#����I�2��{t[S��0:0��� ������]կuQᲁ�O������H"0����p��(di8��m�hb�"n��0H1�%'��� ��ݩ�^��^��~ +���d�2k����:�������1�f-үX��p�������d8�hTɶ�P1X������>/��;����F���?�n/�n��AR�.2��L���$s�n&3�7_���������A�E]3cbl�q�f�ƍ�J�֧Q|>^���G�,�¸!y�JɩpG4K;͉���>�-�FAWh�/����-"L��R),#��p���I�:L$����=S����m�!kW�7�5.�'�x������7v�2Wi��!���u��X���]����O���{����p8��8��pu��y����lm��B#�P媰��z���3���IF�j�m��AVՂo��Ϯ<]�k�K��j.��4��d�����۽���v���I�Am��p/C�`�����V��C#��`���秂 l����Y���H�����Er�M��,�>2�I��>u@���{8hW��^����x>�2�aq2��D�p�ެד|��rC6Xu���+T�B}��=!�mp$(����M��R0j��U�s0,���7���i�b��t*Z�J�]�ݜ� 6]�̍* ���/��u��i���Kh���>�;S<=�6l�pË���Xwp\�aغ��$��5��>]:R$=o�\��%�Q�(�<��W��C���Z��Ƨr䷯|�ג��'[V���W��-I��q���I<�7�1}���"i����y�Jө��%��T+c���Rf�am�n� ����jД�����4)�w�J�eP���k�VZp�x`N���� H5j�>���������ː�����A8���6�s�2SZ/Y����?s�-�YE)a��`������ܙdH�P� b��M�i����i���fX#}W�j�IK�[��q�':�|�W#V�@d�t���xRvن�`��Z9��u���r_�'�蝫��4}aυyy9�yc�4�cק���r�ex2���{��Ů�hkE&Q� w~��:���Rp[a�Zt>�#>�S6�z��)9���s������uYbŤ2�n9��Pd���<�#�z�KV�B4e����*O4�2u�QP>��K[(<u�ӟ�� Q�G��Qgʯn����� (��ò�T^�Y�%*Y���+<^�]��p�F����$��+ߨY^+y��v��PqA���c���Դa(`�j���>�<+3����P�U����y�+#�%&�o ����R&M�o�t��LJ�8�8F�fk}n6 �q����k���'(L8( lec�Br)���%��gb^�[�l*]�rrC455�0j̰�/���Ά(u{}�{��{�.���q����N:���$�C�/��Uݿļ���Ǔ�s�.j� �?�2=4����jMw?a�}�m ����i�|��B��!}�w��C�`�_q��-�=!�H��c��Q��V�JJ.8=o�|W���~��=*/��5�-�H�p!�������1����~7�=R5�*�C���ˌ���ƚ�Sh�� ��oW�/���0S��'�@(H���d���ۏn�����]�]%���I �Ts\�>D1[c�/���C��i��&�TR���xaE^��~\�k������@���k��{W�?����èI�sp��6�;�r��E����j��W.��j�C0jf��a���`�p�Ȋ�*R3b��)�Q�^V5:�����8�C;�Q��ׁz�ن���*:z �܈ Oi���Td��9$�����0f0����U"�m�W��%$O�alN̿N�_x��9}wt��n�3�\�Ga��W���P��WЄ4�Ǹ�H+o��-�1L��}����ȯ��J�S�lм����E��oH��y9x�I ��<#S���メ�cH���6��Id�����R�ꀷ������N��hl�
Behavioral task
behavioral1
Sample
ee280cff14ea7db3fd9c22a249d194aa3bd9ae14d71e42ed6406b03b7910bc9a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ee280cff14ea7db3fd9c22a249d194aa3bd9ae14d71e42ed6406b03b7910bc9a.exe
Resource
win10v2004-20221111-en
General
-
Target
ee280cff14ea7db3fd9c22a249d194aa3bd9ae14d71e42ed6406b03b7910bc9a
-
Size
334KB
-
MD5
c13c8185012df940dcd58433b892c740
-
SHA1
b2f8c56a13449f57ce3d59db7eb6133832f3d62b
-
SHA256
ee280cff14ea7db3fd9c22a249d194aa3bd9ae14d71e42ed6406b03b7910bc9a
-
SHA512
f146bf6ba024d19dc4d67fe42ca7ca9fba203dc2fd8ff8514d3df0384c42cd2fcce052ce9554fb2150d245bcaf2bcfd46c5d99e38ef0b4393df8c70a771fff5b
-
SSDEEP
6144:MWTGCDPMWBQ4+AL83Ty5A+wHnFcYWCVqqLFzk6izq5EkQVnge3Rec6KHp8G2zyzG:NKCDPMWBwA2y5hycQzLOzq5L+0Cp8G2L
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ee280cff14ea7db3fd9c22a249d194aa3bd9ae14d71e42ed6406b03b7910bc9a.exe windows x86
3d94249558ea13855b4235c01d352e67
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
GetLastError
CreateMutexA
LoadLibraryA
LoadLibraryA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
MessageBoxA
Exports
Exports
Sections
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 269KB - Virtual size: 269KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ex_cod Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ