Ś�#Zs�7�t��O&�³Y*�:1Z�V�P[�U;�>������X��3�r��A&m��t�]f�7�PU\�ӱ����S�Z*6%�BCV��]���Z&|L��S(��.?{a���o�~��t��� �0�K!Hb���j��'�~��Gʨ���r�g�0���霡`"J��¹�A/p�y�����L��`�{C�����-��J;���M�\-ʀ2 .Sƃ����ąmkvz��%�Os$d�~���\��t#��JM<N�T48���Y�r��<ᘞks��$+�u�� Cx[�P����٤�;�8���(ܰjoh(��~��5�rю���<j�U$vda&$ �}�C�W{#�.a#��ڐ�s�kCr�.�ۼ-�zd�@jM�!͗�����=j�UБ��k��iA���v��>g��0JE��V��?��t���5weh�Rks)L�rayUn�C`ja���(̎��_��vuwF��0L�ʮ�2A�oʷט�{xl�c+Q����\�M�>���bT�c��T�������YF1�隡�z��ۊ2�����fHB[���43�H%�`�"��H�9m�j?ÛY�f�L��SK��b�S�2�]�t�\LX��낭%�9tAo��3����^��4NT��O��{D� ���?K�I)�/Qa��@6+s�L�V���v8����Z�|;�r�b{9���?b�;�����{JP�*����E=���j����)�~:qT ��Շd����^�W��_�'\A=Z<T��X�pHA2��+����ǫ�B]��8r����1�6��Sa�U:��E�|-UO�����tH�Atf6lyMϻ���(줰�Zq"q�<�NÔ�-�'���os��Hn���C���άBX� �3ؔ��Un��-YW#���k�W1]�W�"s:�W��[�S����v����zA���� 4и���gV�5E�����=nX�>�Xр�bU���a�@B�?�%�=�W�Bx#$O��A��*3�M�X��Nh�A�E5Q�=�@��s�-|��������{V+p��H��/����p ?�j�^���?����PvL�I�NI��tۜ���5�ج����E�@Lc1��#����.^ 3Ǡ��Nw��\<�b ���^^���(�0�='�8>�����v~�v�)�҄�\s����n.$�ǺE�{�����������W��n�S�� �l� `ZW�ˍ�w��L��U<�n�Q���c�H�\�D:��6(̞��@*��#&���D��ɥ!���B"��?34y���.�����D �M������� R蟪�(��)�CIW�8���c�m�V�5�cP�W�ze�a�������:њ���c���J5��1q����w�͇(5���gu���,mϕd�t���0��L[PE�B�Tz-�~_�)ޛ�Rf@�Y��E��#V6�h��w[���t�G�%"�`E��L���^v�1����uBg���v�V D���I�7:\��(�B���6�n2O�k��.+l��y�?�l��y��\cn�e�i��Fת�-�gH<�� ��R�LD���s�E���aG�|���+�0 ���z��E��g5,�^�>����x��4t�'ڸ�>^:y�R�����vs�\�E����r"2�f3]z��⪏p*s$K�]���\5�ΈY=;�K&{fh_M!�ȝ|&�(��;�L�}�ׇ>+[��5V=�+VEvq��ດ)�_O<��4�q ��O�����B�,�o�A k���5�T�7��Ӂ� ����6ݿ���(�Mu-�@1�p.��Z���g�C��^?#��*��K��xV@��`�k����G�ꒋ�㰂�Ӂ��h��4�Q�����Ws�)g��������^������Z�������:!�=n:u�I��a��=;����!����3|&�靔�6�R�|N/8�H3O!�H7P&v��4�p� H�� petV���6@�e�*�5�H�z��Ő[cW�.���x���-�H���w��C��B�fBmyf�(CC����CY�BX��Z)$ڤ����¥�o]<$L�[_��u�V��'Q��t�|2����!��EJi��(9�o,x���'�v��Np@A�d��V�2�WC`�F(�����O�I�D"��l�~u��B(]��7����e��#���������V�}s�q};O�_{��輨P��[ݥ�G�s솓w�O��2ՒSV��%9"�B����?�V$�*wS'�J��/z��)��"��sI��+�3G{r�P���";%,��D �����D�e&���4`��9�,(v�'�p��e��MM��i���&zg}ݳ)��&i-��ʗ�&�V�n�J�j!*%60�B澶�KH�br��G>^��_A�U�s!�U������ɭ�琷t�����":�v[�Ě���ڣZx�L� ]�3H{�;�!��ާ�e���N\+̖�&����y���I�h�T��"�;���s��>urX%i��߆� n�@>�+�yYx1g����q-���V~X��$*��DtѴ��'���@�s�9�~�4�CB[Rs�W�F���q�u����p7�3����H��V�� A�j�ql�KzmU6�y&nC���0���$�Q��$��\���Q�� ިB��a/�R6<Y�9n��8���ʣb�9_ӫ�[U��E�T�����+[G� Ɣ�I�)K����j��.Ó��&K�@# `�K���܆�^����_gp�f ��f{{�����/�9�M�dP�VA�s�ܧ����D�Je��i+c��Yx��k�AR�+��2�NPF3X�vl�aZ�/�@:w0�+v+4&���X��N�U�1h@QF0f�v��p�wxu��`�K �N<����4���у�)�s�أ#����0m/�ȿ��A�ZlFV�??��*�������� |\&\����]�����6�j�t�h@U3\�!;'�uet�/� fg��-�#5���9a�_���&��u�*�O���r�a�ue,��ԫ�Wn@��l[g��)"�5���>' �9 �:
Behavioral task
behavioral1
Sample
e7c38b64096b7023001c235b9510ea198d2a726b49b299bd6702a9d8efebbecc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e7c38b64096b7023001c235b9510ea198d2a726b49b299bd6702a9d8efebbecc.exe
Resource
win10v2004-20220812-en
General
-
Target
e7c38b64096b7023001c235b9510ea198d2a726b49b299bd6702a9d8efebbecc
-
Size
141KB
-
MD5
00e44934fda3732f3b278bd20a8f60d2
-
SHA1
3cd99a53adc08f44da07049d9ae3bcef1a6bfbaf
-
SHA256
e7c38b64096b7023001c235b9510ea198d2a726b49b299bd6702a9d8efebbecc
-
SHA512
793cfe92bad866b7b013b6c2e5f3f03d4b040ec5b87a95b7c909ed73c1b266c7e537b9398483476d46559c6cc222d27144113a48226477bc71116453b585a248
-
SSDEEP
3072:5BP26ZEbXS+RdyBZibaMnxs6tI/Q6yxhQB83t4DLrq:5BP2xXIDi2GH+o6yDmgmnm
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
e7c38b64096b7023001c235b9510ea198d2a726b49b299bd6702a9d8efebbecc.exe windows x86
00d1bbda4e17ec9b6b8da7080c474cf7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ