wa�%�jB��^��4BO�ap��q���cz�8J���<�?�ڬ@��br+���aC6�}��g�T��*.sj��r;�3Tb�QUCp�}�w����C����$�X7f[�cwyG��pk�\}"�M9��<dʔ����Nrm�=W=`A��ГPө��:�A�Te��k��29�T�[Q����99��Ŷ[�!ų?����k�/�y���`dnaǂ }�5OA� ݣ:�[�=��E���v��D������3���W��P}�w�{�V� tgQxC;��<�����t9���/ �ը���F%Bխ����B�@6���|�g�����¥��gS1�m\�L��"�ĸE�]�CgY8t�.��� T[� �����13�;vH���GU�n \T�X9�a���,��2]�;�����?����Ep�ޱ���]�;n<����R.��jh@Ʀ�Þ멽��ٳ�������Ku�!"�]n��V밶��P�['�4��:��P�Q;˓"���5�PQ��=�U&���4?�� �������ח���Ѐ�ȼ݃��\G�8�6J�G���@� ��[ �Hһ��Z����w��N�c������"Jj�8F��CB����h(�8` �/W���w�{�����d���1��+���4��D2��6�ܼ����/��e���du7��#D}��8���Q�M�i#]�����&��,������2<O�]�:o��?^4h�P_�_I�lcFٗ��N�A�ye�Ģ�f��*z�~��~Fa�1���@ ����.�ZU�@D�!���u�mb�xm�T�4I���+���m�k-���g(!vRք��Ƈ�f�<\�T2;%3&�lь�:O_��ʼn��x��T��b=E��(��m:�YX�����<����X�_�P}�.����H�S]c!p���O!��N^�_�h P��8iBQ�#ʁQ>��-�u�>S�d��r%!{ᥑ��c��a�^�!��56����H�Jy�i%z���4 T��tR�rbOw��z��g5�b���vRb?<c��Yލ{��Q[e�#"|v���pC�Uj |��d3#��i�6W:�l�E�j���l��uӊ�)�;��^�H ���2%R��J�\,���2�����hο�A�҄v[ud�z:�I:���7^�;��c�;��z��#���<F����|�K=J���o��|C��Кj���<��3]���H��Q�Z��!�!2��\����n)x�`��v����)8���to�:�*<�p���\ 4�d�$�X9�o�}n�FB�h�mt�^�'���Ր���q��ȧr��i�1���H�"�Ku��LD�; �}��Z�UMmG'l[��o��ì]�_�ZSc-��z���e�s���g���i=����P��ɒ.�t�?{������["�i�� .�2�u�W�M�#Sw��6��o_��ٺ�C����f+|�x�sИ;:e�9۬�-xV�d�P(ҭ�@�]�V�ï�� ��J=����*�4��K�<(��=ڗg:�����v,�%���o5!����F����`K�۱e�6�8ؙ����H$;pt��?��{��u*���ZJ �Ɔ�oSx7�g�!�Z�B��\ 0��5ﴇYS��!�0h.*���.��9��(SY��mDA���T�J��u��i�� NFY���;�̖�*eٶ�iG�C�CQ�<�l��M�t�H0��W:�t�l˄���&-6�/�����0�'E��yW:;��|*ݬ��AQ{�j�6����3������ ��?�Eʣ�I [��<���Ys�r�y������3��^�@�'�o3�쩧�~�c��(Cc8����>�蠭Q��^2hB�9=7ܦ�i���֨M��*�$��oV�2�IrH>m���l� $kG����a��z[@6���e� ��Pnj��諥��n�f����f:�oZd&�7�^E'�l1�1��M��Kf�jd-�} ��ń���jܐ�^99��I�7J�#��+��� ��$��T��>z��oV��5D�!��Mʗ�'����n�Po���,���y��.�Ew�X�'�ZϨAV�k̒}����y����n�\��e�#����7��?�6�7گX#�rh-6��May*�,��ꣅ��q�<��%`�J��=�G2m�.�ɳ���_+����gcf��T�s���Dwn�E����9�{<o�,>�v�i����Y�4Q�%i�Qۆ�/�m��Z���q�� �x�!��AJ���lq�������������z�f�@b/\$�&^ݤ��@�1MI�E����8d����ق�j_Cٱ��E\흫�g���U|3����J`��+�z�U����L$�B�I8����}34�u�@9X`�P� 1Wwז8N Bۻ�[�?�ڷ�����������SGzz��bC4J��6�o���̑�����w�]��8��#vYP;h3��q���i��Y��4o:ƅ;W�y��~����t��z^"��X���Ӯ�W-���H���%-b��}ٞ*�3� �]�N����d�&Re���Xh�I�U�q�&T{`K@$�� �x�{�ף H��+�9�����)����BL˴�j��% D�Y0^��6��[@\����V/�OC�&ճ$�F_���D5��m����CX����� �c*Qb9D��D �+�6�y qݿ���%)R�;*�O0X 5W�J�r�T'�,���?�-&�o�c���@��N�;�qv��I�kφ_��az�[�;�&��/$�#;���.���xBKtLԟs�qc 3�|η�j[�cդ|��#tGR�� ��u �h�����kZ��&'e�^V��(�g4D�9 �C����*d��G#^Z�ַcˢ���rt��Y_R&�*O�S�`�=����\-#K�/��e�Y~z'�B��6�\z�8�����q���`�� d 4�i���r?8xN!��/V�{�Q[�p����}��'����p�V���]�]�H�Q�BxG��A��5,��A��I�u���W���rŞN9kZP�I�4ө6��
Behavioral task
behavioral1
Sample
14da38b3dbf86afd5576ffe968b3402cb4c2978f4bbd06e361bd567a6ddf00e0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
14da38b3dbf86afd5576ffe968b3402cb4c2978f4bbd06e361bd567a6ddf00e0.exe
Resource
win10v2004-20220812-en
General
-
Target
14da38b3dbf86afd5576ffe968b3402cb4c2978f4bbd06e361bd567a6ddf00e0
-
Size
1.7MB
-
MD5
164bb8cf428a0d67454a9feb91a3e670
-
SHA1
0f0d1387e88beade9937c9209fc05591f551620c
-
SHA256
14da38b3dbf86afd5576ffe968b3402cb4c2978f4bbd06e361bd567a6ddf00e0
-
SHA512
d557a3112d23d7b01e75d1d773ea2b1239fc46ee57d356b9df52cb52e6cbe4abf07bebda26108507bee8c68358ca81a09200db2afc1a96471e6b4f55f96058dc
-
SSDEEP
49152:rDq0ySWWgmkIL9N0PnQdfxDgP0t1nfYVx:rDyWHN9Nx0P0t1f
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
14da38b3dbf86afd5576ffe968b3402cb4c2978f4bbd06e361bd567a6ddf00e0.exe windows x86
dc7ae692b42991871b906415538a5677
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
CreateThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetForegroundWindow
gdi32
ExtSelectClipRgn
winmm
waveOutClose
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromString
oleaut32
SafeArrayGetElement
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
WSACleanup
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 640KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1009KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 901KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ