�c7Sry�lj-�n�d�3gLJ�ɤ�0����n}7������Ɖ�̙b5CG������Q ��\��x�q��D�6,��!x���>�������2#��0������_|n���Y�5����M_uE��3f��i2_��Z ;��4$,nt���l�D�}f����f���j�!��h����H��6���pW�X[��65�`)q�Cӱ�Sr7|haHAz�wzt�|���+kRӣ�i@��2'����f�3��;�IԸ ܬ��P��e�I2O����C��Ӗ)Ǣ&(g���1���rM0��0#m��x�p�Ԍ;#p��'�Wy�^��u� ��G�v��KJL"'-�6hl���p���E�ղ�S��̃����9�A߇��Q��!�^��>�#��Z7 �o�u/.�Q� �C��j_S5ݐ�*��/ ?aƬ5ڙh<gP�f@���du��+���x�5�yV"�S����f�jK�v7igБ6r�����P���C�m�k.���0� �ތ���9�ln��"+9�G���ŞO�T���u��Ⱦ��[��hS�nO_���<����2�S!hM�n���u�nD9��t��$3�`�� ��y=I��$������������8���K=�����ȹѽ�#��o��Xh��l^@c�ae�����������+���tcM���BcP����_-z�'��k������y�f�f�*G��I$��GZ�lW#��F8���o�;R ;�����L��Z��т����F�Y����QHoXT�f��f^7�L��Y�~(ݝ���m5t�F�"�#���������G;D�4HeQ�B�_��I���t̠�̓�V�L��5�����(�@��}mu�������N4�C��x��v ��/�8GG���n:A�x����Z'dZX�X�,������Ht'2�H$���GF��JD�,��j��h� �����x@�I����h���ϓ��T ��f��С�=����?oԐO�d���쉺�RZ��dW2��C������% �v�cp�1�UĒ��P(��Od�c���mij ;v&�Zf�Ki2�E��T����m��PY1�!|w�@��Ig!Z*��6gA%���a�s��A �Z���'췲nI�-r윸S�SѲ�Xݙ]6� s��Ȋ����̇5�2�`bGc(���&�� ��t'�f�{p��^�-������� :PȮ��t�-�1 ��?��Ԉ�g�D���b}g�-#����������j�V�(@v�[�8��4�g����V�EQ���?hX�X�l����r��_��` ?�E�r�⛦�J�2��^��Y�+�˙�}�"e����7�G"� Cz�}F9��o ��V31�*����bg#�j���fu�B\y?z��T.�e^t��(x0_���)̵�����P�O�JBe��X�R�<�w���� �Ik���#>���L�l�y(���!�^��4d�86�q^M�\�,�[w�YXL*�������T[h���ȁK����Ӗ0��s�1kQ~u�4��_hI����o����JrQ%h� �A���X����^�˽�}ӎ� ����C�Mh\5 9�k�h�y�be�(�3&��^�{�xF{��f��)m�ތ*^?/hy.��u*�T��E����$��Zg�E�������Kv�=�E!U~��§����D��/��ɏ6\@���/I�6� �z1C�&#�m�\�q���!jJ�E8�7��˯i��������g�Vջ������(���y%k 斘5ڥ�M�_*��xX�$�=`1��V���o*��c��>�#.�|S�� a�/�3Lg)���%�V.YEn�;d?o$M� �\�g����,%����]�Z"Pɏ`>�z����ڞԉ�|UMPZ�b8>�������Т ��l3�:�L�{���ñ��ϯ��ؼT�*r�2�_}�N�Ɇ�`��d��ps@�y���k6�'�yiZ�/�g}'>��ټb3�qy�Ev�ѡ���ȍ��q������4�q?����1��^�vĪ��q��S^p�w0/:+[�%o@P��Z������c@[�H_D���Wj_A<�˫�{'��8���G���uZޗyrgf�Ѣ�Z�k,�����4��@����\n�������o�B�\�%H���(]��/��� �y�5F<����;|�ís+P�,�z�9��X�!���[^�1�V 7`u"��D#_��A$��xz�>���~����ٖ=G����Ƙ�&�C��-�>��ч����D�c����j�Mv2�;����?���Ù f�E�waqs� p�>�q[5��&�ϡt%��'��w�F��[E"[UJ�T�K`���Ζ� ����2bq"�)4�y�"��c}�Ⱥ���a�.-8E��_���3�:>�a]�i}l�<?���"G�W����Q����:p.p'��c����tm�uM���M��C�jԗ��/)���Bߌ�p�6���Vqw�����5i�8�č�]Xw`��y]�@�iU���E�*���WJv�]�2��F)�7�;a��lH�b,]`��3"{��@|��n�c�}�ֿ=�j�~�į�U9�鱒��7\j$��y��b�hMyh��-��_jn�[O���I�e����� gAKKP�4�M�n �+_�e���h�3�BJR3��u������X��Y40��yƞ[�� ��Ĭ<>Xx�o&Z�k2[4?z롬[H�ٲN���a�Nן�6 5.gR�t�m���&g��R;25\@��C!��K$���H��9�HH�]�[?D�~]�9��2Fd��[��M����ٸG|.��� ��٥9g�E �W#�I��!�~�@ ��p���~cy]͵��妞�o��.T{�P��]c����S��/��ѕ�8��M5'�O�d��J7����V3<� �ڹ��7��d<yܡ�J�h{<N��(����6M�s2^�{F��)E+��-�Y ]T�/��b��%ݕlnۢcT].��D����F/PPf��u}S�!].��}�u���|�S�Tp�H�$���OP��PmO����u�1����0,�a��!y��s
Behavioral task
behavioral1
Sample
12b771a58b6534bee58f5c1265c5abcd575bb20cb458ac6f2e516ff4db388ef3.exe
Resource
win7-20220812-en
General
-
Target
12b771a58b6534bee58f5c1265c5abcd575bb20cb458ac6f2e516ff4db388ef3
-
Size
2.8MB
-
MD5
01e39eada4367163daf2512dd9009660
-
SHA1
ee681a6b8aa38d86161704a7eb176599466f9260
-
SHA256
12b771a58b6534bee58f5c1265c5abcd575bb20cb458ac6f2e516ff4db388ef3
-
SHA512
47819caae813026bf5a669382f505403b0bd1a09fe5a01959df3de46c167d4216f5ac8211d1651169638973575cbab849c4028170c6204dc8c1daedfe6d6c3bb
-
SSDEEP
49152:ko6yjrBWoRCnTEyN8P9mvRPSs9YnLMjcmrnvy5wGU76JpE4Ml51cLY+OsrO4fQn6:koPrBLCTEyOmRPoMhzvRGVJOf1cU+Osr
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
12b771a58b6534bee58f5c1265c5abcd575bb20cb458ac6f2e516ff4db388ef3.exe windows x86
1afb0ab2b5088ed6f37b8b99de186ca3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
waveOutPause
ws2_32
gethostbyname
kernel32
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendDlgItemMessageA
gdi32
MoveToEx
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
SysAllocString
comctl32
ImageList_Draw
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 792KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 449KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 319KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ