WLP�-˫��,��`��j{����`Z��<J���9=�@Kźͣ���B:��rz�.*$^��P�7#1Â�W�0j>�!g�� ƧF���^JA� i�K\�hȫK�\� �_�������t��0 {��M� �Ak����+�]��k��Q�|5��+E�n�6���dx����HS6�6Du�Ҟ^~� #�"�]�^@rG��,)�NAvu��φ�|`+�T�8�?�=P�������j����pG�A�H�x���2������?���la��k m0�t�[�f��B��~u��䕸�A��3����-w�����qc�Z�%ZX�Fe#f�ȿ{ϭޟ�4U���%_�J�U�ӛ���*�Н_�T��±�S�]� �Y7�k���F�ch�Q�ԡbQ�0RG�Cdm���̔�v:S4���FB�r0����y\ ��-��ӏ%*.��.�=Xʴ��La l���A�-/�tM�[�A,���� Q��e�<�C�m���ea������?�Pr��� ��j��TJ_A�]Ⱥs�R%�v��*�l�i.9�k a��iP��C�$�k�EydWTL��wD��c-�hMH��������)uG@���5�O4���9 !d\>Ǡ���k�P�7�Acf�t��E�PJ�HŅ�r��ڷஈ�C�������_����F�O� �tQ���"5�D�xld�j(~���ޥ�I���0W�R����Gx�4e��U��&ǘSs�K��8�jhh������Bw��a٤lq�&Q���\x�8Uf�c�WF��n���]F�~��X��"�G�N^��s�%K��+SO���� � ��UH�s�*B^��B#�~a�U����=,�R����/�����(>q��tH"�/����Y��mav���Z�V�rq<���b�x���YT8�݈^��� {�!��W-�̘]�hGP�;N)r����2]���^"Py"��0ͭ�w+��� 6dk�Rc4Y$Wo�_`7�|X{j_�D�7y�!�wj�`q���= �6F<+�:�Q\<�5�ĈFl-���J��j����ob���y &���FI��?���V�7�z,�g[Gu�1Fo|�� �x����!�=�z��M+�&p�F`�k�[XP�_z�5��G��~�8Frl�&����CU71o�Ǣ��!��]xV,���L�Pѫ��tQ8�1�N�>�L+�lA�yz;z�o�%w��)�_bZ+�8�j����y��Q˗�����f���]�O��L�i6,3A���(��������g������7rS��������gf���^;�g��ƞ��1�1��]��䣨 ���a�g[�-�"��e����[���]���&t� X}/�Ĭ ��t�����=�*�(P��n��6�^�:,I����UcE��C�����7�]��Z��s!�Bd յ���,9���{�Є���e�1�4�E~�!�̳Ͱ�|7�[�b���Kl A�o��4;�a+Z��'�q��#3��l]���)7�a��}p��'HJO5��5&�Q/�Cd�4�,��$O=#�'���y���!���ꩀ#b��-�P��6M�>�Tb\�gj��`�������Fع?��}& qŌ�+Fɮ*�OgS��H�c�/�%�n��\(����(�SK�� 8?DL����롘y UЉD��P_�0���(�?w�7��c�IL���� d�Ü�<ÖA{q�m;��q��(_4�=�X��`�иwY��*]o3�h|s�p��S:��i�E�W�(�M����H�m��)�٨�/溑 �b5�=uV�~_1O�Y5 �CB�S��/��$�w�5�>�S "b"؛�p�w�k��-�C6-��v�_hN���������K3��6ka�\t�����B)�&��ɍ/ෟ�ꑀ�*X������f�&�mn��?��^P���u5Pk���oES�Ўt�\+�����V�e� �h�?bSM2%LS�k3e�KH� )@;���x�R�@r��(�PK^*�����{:Ƣ�N���2�%٠��界�[�ˡ��:���K� ��6�D����];����wP�d���8���M��9)T���4(���ڥdy�U�<�?`' �}�c��&r���w�-�5$uk�L��r�����++���-2���gQK@po/JV�}���VtOZ�VG}8��� ��n�!�� z��/m͆�Nڨ�n�傫Igh1+\Ov��z�J�n@:�|)�w�@�#�h]�\�8u�D� ��-�J�_J_w_B� �t�'����Rq�P��L �*V�-��u�zq�z���hu��ku�wU����r�����KII���d@��Aҷu�ӗpr2���d�h�����#a�GL�iԳ��S3����w;����N'=N�L��*q��3�х���+r�.�̩��Ґ�p��bHw�̠�6 �ZՖ#i���� �l������N�.r�һ\|��qӟ�ϰy������ g��4��_0P��DJ�Sߋ@خ��D��aw�C�%Il�D�%�dc�y9�#U��������l��e��R�M2��b�� ���)���L�n �n����6 �!�����ܙ��YɴGCc����{��iC����9�%8�^ub�Qy��Vgu�-S�<�:d^���A��-:냦�(T��m��^*���=��r?|[5_6���lPiV���CO@¿��b�Z.�3m��H}��-o2��A���ԔŬ\e���f�]��^l 0�7M@|� d���8W ���vP*`ISc�"�b�)�ng*�� �8��J��0�aJ��"��@�)x̌Z5���ޅ�Z�BB�\�������P��~f3D���^�p�>'�+:� ��Z6�zl���Fp� c_�Z`w���*_��v�Ŵ%<� ���-s�a��餴������]��PYM_O���[.�{d� ���i�.�O�'X���BƔ��?���$B�����,�3���hfd2��V2�z>��]��B����B2�%S���$�R����CH.���rL~��<T����86���Ћ�c�i���]N�
Behavioral task
behavioral1
Sample
168_sAZxlZ1ZgG.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
168_sAZxlZ1ZgG.exe
Resource
win10v2004-20221111-en
General
-
Target
168_sAZxlZ1ZgG.exe
-
Size
5.1MB
-
MD5
176b8329bd9030003935dc4617c7c10c
-
SHA1
5959a412e859952542d3493c2a61c06b0c3f3a00
-
SHA256
9695f431dbc461d66a25892972418f6bc9eda3a8b0980d560b2c307cc0d8fb41
-
SHA512
b5b1ffeaf6ff7e720ddf8c257663b98d0858802034b8566d9192470d322cb780fb727d1a9c8677e059251bdb6d172895b204a4d85ebceb93a5b3056b8c969c8c
-
SSDEEP
98304:MG1rWpSrAn+yiDBkoQZIe6LOys3j5I56lV0U7cWf3AwSUcPpJWa1c5RWlZqvM:MGUMEn+yQWoQqe6qvVImSU7XBXcRbi8l
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
168_sAZxlZ1ZgG.exe.exe windows x86
bdc900372e30676cd8473c603dd75515
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateSprite
kernel32
HeapFree
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowPos
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
AddFontMemResourceEx
msvcp140d
?_Xlength_error@std@@YAXPBD@Z
urlmon
URLDownloadToFileA
vcruntime140d
__vcrt_GetModuleFileNameW
ucrtbased
__stdio_common_vsprintf_s
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.textbss Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 303KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 509KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ