Ak ���٨��������#y�7�p��cT��S��� ��QxC�1Y،-ƿ�HO���<fT�Fʍ�e���D������m�'3gL�H ߏBC��,dQ�ݝz�M2H�̄�7(@1]�Z�vN�|)�|C���&�V ��%��_2�E>-j�OxE� &��%4 ��=>@�ꣶnj�hX�xf�&`Xy����%���{��V ~�Y8��FeM�CI|�5�F�Ķ���oD����}�v����4�H���b��YD���26zp����p�ab���5�ˬ�m�����$c���D�2eEQ䃦��)4�1����x�R]���>:���p����a�����F�Ԝg��G��rT�9�ڀ>������t����� �fZz+�����]n�C>��Œ�l��^�^|���x���+0Q���hR=~�;Q���4Q嫘 .A/Z�)B ��uu]n�?X~�s��t�lCZa8�H�<B�eU(���K�Ř��I���]j����!���0� E���d+�/x��^N��Θ��b4�:�G �Hb.�Y�n@f+@�d��N)3z����4��of���/�v������+��W5[�U�V����P9r,�e��1o�����7n�u�o�Am���ǻ>ɊE������5�p���v������ҁ��Q~�JΜ*H�Vյ��Iv�?��E���R+/��d%�e% ���||ȥ��70DÐ��J�E��W��**�A�h�է�#����;~xO�� ��5���03o������M� �w+{�߫J�y������,��Z4Ds���p�O��[�wg��o����\�G��I��#u+����^Gi��Qc�Y���5��R��鼨��+�O��9�Pu�UB��IS��{���c��s���o�M5�M|$�]�aT(5q������W��3��o�`���v���X�Wo��ˠ�%u�t�e��o6 ����`���r+��v�����*T-�}b:)2;�1���X.�����1G�̡F���oz1[l���LoF�|9�V��픷��E�/� 1�����6G���Cga�'#�sQ ~ކ䜠�HY�X��Nj�fo� Q�O��|�T6�^�܂ZW;!j0S�3�[�Bν�I�.x}��YtMWzt��{�Y������ ����pn�eR힍� �i�a�8}Ĵg�p Nd=~Ukn�`�Ɇ�;:�v���wƕ8$���<���W�TY�W�b���P �:r"���T) ��P�EA���K����QI�zj�6\l�����U++��a�K���}K=�b�B�XC�H��Òo�g}_4F������d�4�>�� zE�� T�Y��l��]8��=#Щ$� .y� 8g�ƿ,9|�'+�@��<3�j�����"{3����>�R�'����p��\�?c������G�����w�>���E*Yd�ǟ�#��8�S�>���G��p�Ϧ�$�bhhۄF�� x�?�M8N��EϘ%+� :5�>��F�q�d˙��6n�� p�<���D�s'E&Kj������?����FY$PM��%�o�$X�U7So"���F^��l�N����N�M-S���~�!�h��3NJ�v�C���m����ůFb�+ �oi��B}-�y�j�Ĵ���;!�,sik/�����(�t��L���a>��C���)�����ommԓ[���� �m���d7RsɅ��uy�i=�t6���x�d�`V�j=�Q���pC�"8B��AM�ts��Sz���dd�JP]̧.EmN�+��?F~����J ���g��0�#j����V���@�1}������ּ/G }l5�U�DV ��#��pB��v�:Yq����+����w���M���k\LE6 Ş���Ve�OR��z�Xk)�FB�H����`����(@B/k�EwNJ�:�3���Y����MP�U´�x��N�zc4��L�l��B��J��C�.��&�>��j�rn����Dm� .1��Z;���%�z���D�"�KxO'�q��C��;���*��s�*�Q����}]�6X������,�����↣�?���#��)�����)�i���K/�&8 Rd�_풄�!yvF�J#�*��P�Bd���ؖ�;�����O~��Kn����¿��'vI�^ʤd>�����d��v*�G_�t]�@1�TDQ�6�T��� �4�Pq" P�1ģ�>�2! ��#/I��z\�9*%�J��搄^� Md�_��;�����oyj�D��/������K�2�<��r�ܫh�٠.;n�0F a��6�|�����m��7�jB��ĕ�Z���?�������i��3�j�i�'�X6^��Q�v H�!<P��a,|P'GI^�Y����;�/�>�@W�_BX��>�b0A^΄o�}0��M��q�>I8hS�F$��sRB���;o�aʮ�xs,�hX� (\�/���;�����h-�HM2h�b����F�R�ˆ�.���OU�'��u���2�&�-&b^�-5��<ǻݗ#�H�_��oPeQ�Lȗ�-Cgqrb�:�6i�0�������BnJj���~�z�S�I�}�%jj،��/r���l�T]@_�[��w���d�m8�����f<g�8�o �z�U���L�3����ZX�����C���ԛ��� `z;� ;Z�5���E��f8�0o�{���TbKƑ�Y�N�->x /[G����Ğ����k�B?6M�?y������G��K8�f#1G�s�*���q-r *B��T"/��rK͙ҥ�|���:�����G����dv��M� v�4��؝We�Wh7A,�`���"�*�f��#.���E��"m���̭T��p(E�h�1�Je�j��n�����,���3�T V�{U�D����)��8s��A����b�@�S�L��,���E��GY"J�`�����*�;S�&��,R1��&����u��gKf�B��;����><��ca�-�}-��V��O����]�b�1�#�.�M���ޕ�b�����
Behavioral task
behavioral1
Sample
dd68caf429e3bc83497ad940432250423dcd9653bb9091a7a179adfba59af433.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dd68caf429e3bc83497ad940432250423dcd9653bb9091a7a179adfba59af433.exe
Resource
win10v2004-20220812-en
General
-
Target
dd68caf429e3bc83497ad940432250423dcd9653bb9091a7a179adfba59af433
-
Size
376KB
-
MD5
b727874fd022e8ae75bb5039d986a57a
-
SHA1
9493b1c3624b89424dbd99c390cd097375c0f23d
-
SHA256
dd68caf429e3bc83497ad940432250423dcd9653bb9091a7a179adfba59af433
-
SHA512
2a20e6e77f7e7853309d79a5f9e797e76fff78ecdc98f71f46bff82af023dd5e955aaeeccc92280cd5af05917f57d29e3815e920935d533f7a97102c7152d7d4
-
SSDEEP
6144:kqU9hyQY+Uv9gIuxRkPgDnatDWj1aoE52oeMcvA6Wfb3WwyKot6BYAA+9+qZFrZD:k3X8+U0LkPgza7SINrWEoEWAAS+kZOy
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
dd68caf429e3bc83497ad940432250423dcd9653bb9091a7a179adfba59af433.exe windows x86
0f3dfff763da98c6c9f6cd62c4e8d9f2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord517
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaOnError
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
ord309
_CIsin
__vbaErase
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaPutOwner3
__vbaVarTstEq
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
ord644
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaFpI4
ord617
_CIatan
__vbaAryCopy
__vbaStrMove
ord619
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 360KB - Virtual size: 357KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ