�M�u ��V����b�b]3�K�� Jx�����<b% ि�^~s�hZ��=� K��N���XT��ʫj�����qFP=�c;���a#�e}[��UCV�;�1�yCɁ{i�b�S48��̢��N"�H��}��� )�e�ƘR� #�ۺ" (�Ee�,������&ݏ|8�~������[�²����Kc��q3l��d?����m�����1?�BG -DY�y�I5�V6�3��c���M'�}C�m��}Aso[�+`��S��+����M:�x%����5�v?�HW����D@O���Ǿ�~��ٚ�^�DM�S�K��~ ��B]�ʰ�ڭ��3��^����$�r!���M�&�d�F����ݶ��5�"˄� ��xr�������H����3S����q�*Ð-��v(�N�HY4�!Y�._vܻ%F�W0��nG�&�Jbq���^8Y��J�m�5�zO�!dY��B�!B[�P���J����q%�͚1�Tf��膇*���P�%�\&R�H¤EK'\ۘ6�+,y����`Ī��*ٌ=��c��N��(x������p�0y�,$�nF%^6c䅲�C� �>��0p�{?Q��i�e���Eu���T�ַ�؝�����01A����0\ �3R� B�;���� �'�;Vb���6R0>���;9��� ��Ĕ}�V����Rn�$g�(��g�G2����n0c�I��z� �^���S]��@r� �X^��.��B�+k0�z:a��6���������� ��#I����V�a��s��4R�B���!���:�Gg��)[��I����t}�����NӊrbAre�.�Q�����P �0�Lr?���bLS��x&�c�ٽ�G�ln�M��/�%�f@�&3�(���3ZHʔ�]|�\3���vX�OS�B��C�6���Ї���q��cߩ8���XO8B�����U�����~l> 4Jb���Β��� }�����N��BU�bt�"M���Px����2�j�qØO��H,0���=��s�!���"�� ����%ô6{w_�A�&\Y��͟�}�@3^�-�����+5joЪ��Vr����r1�������9��[�� &n�y4r��� }�nf�k��AͷO&���Œ-.���/v�� ��T�,ɘ�>k8eUSM;�g>ut�2����,Z��d�����,�H�,�'(�ٯ��(f����a2���U���e���w�Ý��!i��\t?$�z�zE�Q �&e���o^�w`y�����L��ѐ@Y�Ͽ�f��H�D ����db92��l�B������O�����< �@|<�j0��"j!�g]{���qef�WGr�k��rT?�R> �mKP�nCI gc�a/���8��?��I����LN'�'D�5|�����iy���5� At� ��~F���z�uP�����~��=Z���9zd't]yPq�(�o��m�C��9l��Rrn.9��35j�g�H�4Aԍ��̖ޙ �z�H��bT*��fh5~�,:���R@����\�B�;_��_Ր;���2&q�{����"��}�[|Q�+! ;y���+�䵯l�(t��Bw a~�lz�\��.8w���D��{2��b5@n6�h2hX�9ǥ���ÆLdY(�?������"B�B�5����2��V�gQU|�R� �]'���~'�N�bJ6���tOR���PS]�gՈl�gE����Lݎ{A��������&�ȧLtxz6�P��T&���n�����\�v2��v�$�w��otEE(K����A>Q�,�pA�Ь�y�tn�j��,Aг!���6,I�I|�8:�85���u���2B[��p8/�#��UXܼnq�{��'rn��� ���l�D3���ëh��An�f�ZWe�ד�*1���m�'��E�.��{dM��42N^x�/���p+na���v:��o�^{��qF!�����Χ���IQ�@�{��m���&y_��ҥ��P4�W��!����K���F [w#�OM_Ѷ�~$�<���TN�p���� k3��c� ����w����D�kS�]�Q�\�2��T�~��`W�Ȫi��[;�ƽ�6��ӯi�vTg���Оt�,�q�jә�l���梛I��T�e�CeB�%#:��<�9�b��<�r'��T��Ò6�����S�H��ꄆ�1{,�sK����(*WC��5����r*YGu�b��ܢ���8L1�� �ay*m���1]�*ڣ���`���1�7Τ~�]�`zCa`�.#�W��j��d���h<�n��N�e��*.��k�P��*�\efE�xyscX�����&{}��"!�!�}�� �"���� GWw�5JJ7B}��Z����ԜT��K�M�U$�jS�&�7 P�_2�ļ�S���������`�-��tec#g���ٕ�T�쮒��7��H���}V)XI��Dd31��d*��(t���g��}���ś�5~ Ԍ@�#��o�h��@_��*NTf~�#���d�t��$�NT����-��#��u�w��ļ�H��S[��l���d<,�����=�A�Wo�����q[2O�<�v��o~� ��U�պub�9�W���W�֦��:D��_�t �<�겗Z���sJ�F>� �6v�+��{f��4�O��=Fh�����t��s�6nfm�v�W�{�d7Ѓ$t�d�N�l�5R��{�����bxf��ꯨ�>�)��%��5�|�TMOH�.�C^%����K�I�a�q��e��q��;��]ǰA�8Ҷ���֠�=ƴZq�:#C�d�I�B�k��>o�Cd+�S ������I-��ն������G�Ej��E�ZP�{���< $� 8<c�OpC�ܲ�"0� �+:�A�e�ӂ�6�Q���ܐߕ�Hg�e?u���s()N_[Շ����MM�o7�L�̃���:|�0m�:ۈ��A/�{��X���L"�<D���5h4�#tF�v1��]$�����yA^�O�J4����d��_���g�L*ݫ�|��fl�;�:�*�Z����W�48�W��wd�
Behavioral task
behavioral1
Sample
99bb89c7ca8d437ca93c4ee8ba4522ce6ffdb311cf8c46a4dd828d87a6ab8bd0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
99bb89c7ca8d437ca93c4ee8ba4522ce6ffdb311cf8c46a4dd828d87a6ab8bd0.exe
Resource
win10v2004-20221111-en
General
-
Target
99bb89c7ca8d437ca93c4ee8ba4522ce6ffdb311cf8c46a4dd828d87a6ab8bd0
-
Size
508KB
-
MD5
19fa3ff91a70ebb08f4c8908a641cc26
-
SHA1
3a05d25ed1627c6232ca626edef26904144b7ceb
-
SHA256
99bb89c7ca8d437ca93c4ee8ba4522ce6ffdb311cf8c46a4dd828d87a6ab8bd0
-
SHA512
6988a2f5abc40c9d7a39d39cb125f7d156bf86b2957d17fe655511053d28657892c51e5ef032a3c3919d1bcad88fe46ccadf14acbce4d8d8e0ed2a264c1d8361
-
SSDEEP
12288:f30gycnV8kJDAAcS7fQWRHcKcO7pskvvy6fZAY7CTi:f0gvneQ85ifDRxTakny6O/T
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
99bb89c7ca8d437ca93c4ee8ba4522ce6ffdb311cf8c46a4dd828d87a6ab8bd0.exe windows x86
0f3dfff763da98c6c9f6cd62c4e8d9f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord517
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaOnError
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
ord309
_CIsin
__vbaErase
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaPutOwner3
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
ord644
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaFpI4
ord617
_CIatan
__vbaAryCopy
__vbaStrMove
ord619
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 405KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 492KB - Virtual size: 488KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ