����#�Um.\�Ͱ��zEU�(���� �m��#+I���ԓ�������C�ܱ�SIIz����)ɒ:��a��T�coN��뎪W�����}��)��|�fGl�% W�W�o�7Y����/Y��w��hF��6�e�s�*ˮ���x���l�g��U�����eO����)��ڣX �~%K�knj�!f�\�z���0�gPø�h�J��I\����ٗ0�/����'���Vn���}2� D)�ەPs��� ~���`�8���x�X2F�5p�^��c������o�q>V�4O��i�y.�f���H`��Q� y��_y��l$mt�l:5�Jd2�\Ǥ;l�uV��ZO�����s;��s�g.�,�1���M�i 2� ������-�T��n^J"$����ӊ�H9ҍG���S����q���^���Z0�^R�?G�e"�m�K �G�G��1w�l��J٘P&���{H1}�f�q�õۚ�OG:�)s��x��ô��iU3��s�ͯKQE�jX�>�(ز�G3��3�x�<4d#rG��x� B*(9؇34��&��s��<l�l��O-k=�m��!=�I6r�k���)�8Q��I�/�!��g����Mr%1���b���F��8�n�~���ӄi_������B����c� �m�q�6�y�/��7S&���P��eR�@4��Y%��"BSDZ���W���<�o� �Ȓ�kg�ܳ�$(�<�Էl���~ k2&���ϝb�40dp��U�sM�+����D��h�����M�Wb\~v�:f�Y��ʔ|�x٬Y]�5rs�� �t��[Y�U'8���z\)�O�tI@�MW·}�� Վ�c MA ���O��������dH�<���!�۞s{m�:�8t+�R������$�@Sr�bL��]�2���ͭ���Xc�����^Nk��)�� :%�v��� j�pY:3>� :�5��Xs"ab���\�VV�׆ q�ݑ��ݰ*��u��eL.�e���z���T����i_���Yގ��щ1`���VӞ_B�#�,C����. ��S6�EK��i�R��Q�_��J�!mu\���ɍQ]U}mx`������\+�Wo�[V���vuk��Nj9,z.�Q+$�0�#fմ߶��{���O���Ft����s�9�n�ߐJ��@B�H��/������V)�u�8묞��!:8$z~��2�0;���y4��܆�><o�� �``_ޫt��_�ON�9�dT���R��3��C]����7�%$�8�#/�:O�:��+��Y�FJ]��Uk(��뛲`�^�� g$����:���P�R�4�D�o�`�|~"Q�n&,�۠<��K5���.{N��MI�EF�K1�*�K��PwRC>3���C��'�ɸ������*�%'�UL2���1v�ׇ�J��>���V \J�\�6��/��U�,�*:w݆�d�����ge;�V�OSB:�zVx�\����_�GH�}=�1�0�!�@���c�W��-��>�1 ��+�-�.>��VȑSХN�����4�F�l���{b��VsQ�8���y���K�g����Ɂ�|�4,��y�/}66VnO�.J&�����,�4��J�Z(nT�J9�3=�ﻂ!�o��/,���>��� ��'7YDÐ�=�:���c��ƞ4��N�b�,{����}���i�\�֚��?�sX��{Ը���]�;��y��C�Gf�."t ����L3nkx���̛�[��'G ��0�(��_����|1G�R�����줣ᨼ�N�T7��� �����^��7P���1f��5�Uq���1�B�X�U_(mÛB��٤�T�2'؇fr@����^pVO� )�4ߝ��Ӟ� �\+L�;n�����++"jҌ\1~�p�%�[V$���"����<�(��𨦼)���U�Ƶ���:un��wiX�͑����5�{� ��X~1����< ]8SAc?��(&������Un�i����6=�$q(��>p���7�S;B�~@��_�6�x�}Ѽ����b���\c�_L�@���6=t� �B㍆Mg��:�>�U#Y���R@�e������5N8��넷C4�=�Yc$��L(�� �����L<ٻ�2j!�]�JȦfu����Q��7��fЋ}�h�-�����`v$�D�W�!�j%\��.m�C{Q�.�M�(?a6ѫBE�y�x �����4թ���TH��d���C��*�w�� ���/]{R�2l�T3C�n�}%ty��<s��a�{������&u����W۶EuN�������K�R��i�"�5 GqM��yQr��8�P�����v�]��`T H2>��V>�l褴�QL���d����a@���u� � ��f nu��9j=!�S�;�;-�y���^p2�V�9�!��� �B�z���R�]>��E���jO1I<1B&����-7e�r��E�u�Kt� l�A�gdE��(k��#k]s���6�W�~�n����]昬"��J<g�J��E�*+���2��ֺEi$��do(�ڟD[���#FV�6=r����J����"�!��۪�DA}��1U��� ��S ��GpWr�#R����7Y��F%ߦ���~�R�Ǥ���H�>�o}�U]J�NB�6�XR��U��%��$P���yP�����/����qA4�*}����qH�,��I�Fy.�~�H�x(�P�b��8�����8b��z4�������k��w�ovM'�������X ��>b�+~���%qAvt�rʟܾ��s��4�"[wZD¿����>ʺ˥�p':k�[��쎍���"�7�~7`��Uu�{�F�k�< �EH�c ���1�bi����#[�uQ��|l�hOy�]� �R���WMz���ks�bV�Nz1�/�܌/�)���#FM�T�i��Ho*�����<�UX�K�\�s?MԮ0���*�k^�~�[x���N>[{A ��N 'B|�;����=L���u�crm�F�������Z� s�4[�ת���$���8r���X���¸d�KPz͔5<7Q J����I���^/
Behavioral task
behavioral1
Sample
dfc34888976a2cf4d2c2d718af3f2229ab337d65832ba9d94832f902934533a9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dfc34888976a2cf4d2c2d718af3f2229ab337d65832ba9d94832f902934533a9.exe
Resource
win10v2004-20221111-en
General
-
Target
dfc34888976a2cf4d2c2d718af3f2229ab337d65832ba9d94832f902934533a9
-
Size
8.3MB
-
MD5
f70f3e4fd82679e4e459963816c17d46
-
SHA1
bb531278a0bb9da3e30616d1e1640e668bdf425f
-
SHA256
dfc34888976a2cf4d2c2d718af3f2229ab337d65832ba9d94832f902934533a9
-
SHA512
da8aaa1196329a125e9cb9762c737e4c86a76a2a36283c502d4c1247b26fb02c5363c4ac549f6d1f7888d3cb41ad4d3b76bdcc31cd14a280e1c694e28095a97e
-
SSDEEP
196608:qL/7C0T+61ByPnNHykTUXBt51TpE0sJnMT0t:S26p1BInRy5XBt51TpEFMw
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
dfc34888976a2cf4d2c2d718af3f2229ab337d65832ba9d94832f902934533a9.exe windows x86
4b7e87111c541b22b4d64e49eb3bb99d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
ExitProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegQueryValueExA
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE