����^`��\���KU���Z��o� b��P��Z����G��ήB���ݗ2O'��=w����r����؛89��@�!�����-��śs T"�����*��vR^�Ԓv^�!D�\#�C���/��xcpzh�R�P�Y�56j�7A+�*����W`)�o���ł�� <WG�m�� ,�M��G�"ď*`xyx]ֶ(�du�鑌�;���г,������4�V�U��I����P�foۙ�C��2q�7���T+�uZ���K$�v_�Ӕ���NT56�V,��rmOK��s�z���x��!vSw�v�g;��@M>|�s�O�ӯ�>�d�q�[�W !A�F^�)��\D9��Ich{�>(�����.�7��K=��߇���N���HP.�F��m��ɪr�[�� ��KD�R$�����-�k�g��5`q;��O܈I4�:�Ͱ����YN�<��-'B�;7�z E?��w��)�kr}�^�� yʺf�a ���|��X&���PH�AY�W�h�I*�B�%V�a˥�w�u���W��D�0\����W���� ����n��s3��?j�fi]y�5��o`�s���H�b�N�x�Y�t*O��Q�:'[0R6�.�rp�K��6��@�=���yq�7��9x���#$���Q�r�l���b�W�1�}2�r����!�{�P=�Գ]��GA=����!코���]���R�;1��~��xR��b�4Y�)uY� �+x���P[��K���#x (cg��A^���QPz�b�k=��`�D��U1�� E"f��ƙ�a3�� �m��Z��$�W����ؔ�^�^y��'����#���/���ZB�����~�\Y~�E�!��f��Eȱ�c�\ݾ��j��I>����oW�`P]s�V�|�I��~X��e3�����A`�ɛ^ěX��]�Orm@�V�����#p ��8ɹ��UkV��%��K�W�S3�ұ]Q+Ҥ���p�iF�8+*�`�����}z:�+>yH�j���z���H8��d$A��{G�4���u����#��_��W�*�k�p�J����)�`�ͽX�K���"�p� Bx㞞9Y*�����'��x��>��H�0�զC͗a�O�P�( ������& �\���)���8� dy�������/J�A{5���Rj�iU�{���]r;�~:���"�Rs�Lv[�C�)�Z��Ҟ�tnX��Y�Yev���������vJ�Z��>��"���|��6�S�! �gy�>�>re���s�ۡi��U�w��K�7@,P����Js��q̽(ƭٿ�����^�h��0���d� ��Q䡕e�������d��q-�.ƍ}G仕����!^�.��ͫ�_�tjX(��jy�ó�g$z��1��g�m�P�8��XP]���R؋8�F3O�v�&�9}}�j�W�bೲپM���uW��w�<-՛�m��ޒ5��sd����l�s�n�������LČn�;�O�X�x��Ϣ��Wr0*R2������U2tPۑ[���c.2����9�F�)mT*����j�>�?���5�s��,j���;U��y�^11�v�M�~Aܻ�R�bUmTԃ^���~�z�� ��F[��G'��Y�8���U�}�E�4��S���d��Ӊ()QQX�dB/�Elh���ɂ���,� s Ct��l�w)��,� �57M��0x��sQ��3�@���[�I��V��<p�Ͻ�'$�/���&P�����1Q-ʧ�3(9����ܾG|�_�b�N��Od f��v���N�������nJl���S%�$S~"`V7ZL؇P.���x=7��k��GsS����H���/?���\�;eZZi�O\]V��/�5i��q�]�ob�j$�n�4i���$0�X��H�T9T#Q��{ʰ�f�������r����)kA9�5%l�|}�wz���Q.`Z�y`�E�C� �69�0A{����t0D������L��w�2�{��fƚ�/Q�� <S3^M������%����r�oX&~��NZ��^ v�4� mxq>�I������u=m l�<;ͽV0$18F�t��}��U$T��7��c�v����&��r8��0�V^���&*�~"E�J��"M���c��>Ǽ��b$���l��Ix�!��P/G��g���TQ;:�)��5<�ߍjq��(�����cI?��D����ŋ{��k�m�|�=�g���b),p�����=��LjA��l�ĖD��Sb��ȅ�g��,R�[:d�M��EOW�����m�Q����A��(�k��r��ʒ�(���?�gMu�0y:r��O[��<&�����MSI�K�s����f�ێ�}��=S�5���������09�a���|���\�49 ��_P�b�Qqؾ)�%Y��B����S`�D�&�)��n���K��V��qʞM��T�&ো� /?T�����B�-��[��F`��nx���;_o!�%i1z�Gn��[�VX�N�LP��_n(/� �zڗ��;�E��Y Z��L���*�RW<�N����) B�J&.��m�L��ʐ��f���7h��� �G��.⾒e_2¶��\�/�7|�^��c�亢V���3U0!l�8�W��e��� ޭ8Q��x��P棘}�d͏=�΅r >kiRC���J��FZ�D���'��̿�iz=��c#-�%��6 f 0��RAQ�B����'�@�@�L��-���_���N�ݱ�Y(����?��h�*%�#�����VԭS8���������'0��g[E��g��aIw�w�e���Մ[㋗G�t_���8��d�8�!�Xh����˼]���J�I�+JZC~�qFl<g��c�p�o���f������=뷗e��;��s�-�N�=2V�,s媋E���w��ԓ%�:b��xB�$�JI�@�� ��W���ꭧҵ|�Y��c��K�3�lYx�lW�Q9��v���~��ݮ,^�𧏵��OT�g�]e����QU[g�� ct-�s�ȄJ�p�����&���݉��5z�5���Y�[/�Y��ݴ
Behavioral task
behavioral1
Sample
7de80d3b2d8284b4b0557f8b70bc37c0a052b30f110a409662b153694d2a293e.exe
Resource
win7-20220812-en
General
-
Target
7de80d3b2d8284b4b0557f8b70bc37c0a052b30f110a409662b153694d2a293e
-
Size
9.9MB
-
MD5
62f81f8f10d6824546eccf2c0de1f10e
-
SHA1
cda58f1fc63a00c2720b32988a475165e7ffb13b
-
SHA256
7de80d3b2d8284b4b0557f8b70bc37c0a052b30f110a409662b153694d2a293e
-
SHA512
9c0ca6beee9906dec423ce024ae12fa7ba6007cf6a5f7c7a5afb42afdb5be0abd93b1febe3d34a5d65cab741e61c31a528395f598956131bc1ed74b95bbbd691
-
SSDEEP
196608:REky+XOrki0MWT4jrQG4jywuqvtf2pt4jVWNR0dm73rYGa1RBAycRryo3YN1irxU:OJLIh7K456RaMrYGa145VPYN1irxviNX
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
7de80d3b2d8284b4b0557f8b70bc37c0a052b30f110a409662b153694d2a293e.exe windows x86
9dfbde1c27f4a3ca1d3e760cc2c1ea57
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutOpen
ws2_32
WSAAsyncSelect
kernel32
EnumResourceNamesA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ModifyMenuA
gdi32
DeleteObject
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
CoFreeUnusedLibraries
oleaut32
SafeArrayGetLBound
comctl32
ImageList_GetImageInfo
oledlg
ord8
wldap32
ord29
comdlg32
ChooseFontA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 321KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 9.9MB - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ