B�� ��~����//^3�ҵ�٣t#r���G�5t\���y��ۿ0Y£�*�Tz�_o㝤Э��J�����G�� V����dwoDWK��� ��쎷~��Ԕ�z��H��-#4�kѲV�Ӏr_�k�)�8��������i�E��A[©-�wLƔ�����Sb�(�8�5���m&F����$�[����}�i���+ݻDk{�j��D��!�j��7̋f�L=�%���9JW˻j�!��y���eg���F���&�&V/e]S �� >�8ۃ̕c�[���\�3�O�����B!w,�ɇ�Z5a�1t�f�2L�g1~������s���$*6�"�W��?�b�b�57��}���$�h�$ �,�v�+}�jTT�$�E��������A��6�A��{�{��2{�BKC6���.jo(�tB���}Z25B����>~���X�.�uM܉�_��$�x8g˺�2�c#qd��w��_�+r2�<��m�M��,?}�'�cv�q��P�pZt$r+�c��Ę�n$��ˉA�Iދ����ȑ�78a�i>��c_2(}���d#um���IkPb����������$�9rZ.���%�]�vŘ������ ��+��K��ۘ��>Bˠa?�dJ�OyCv$�����i�r���1Xr��D������>:f,OΆ+Cp�hzx�M�����f�����s��e��=r9r%�)�c]�����\Jnѵ��r���辕e+��#7x��k>��Y~.2X�sw��C���(L~W�K5o���y��J��7������� )��%�qs|�O��e���7��vـ���\>)�&BP�M3.��i��Z�!�.*"B%�>5�ٌ��XÅJd÷ޤ���%ܛ�nUȗ��x���DL���Gt3��� �� � p�7l�me�|�VE��g���Q� `� ڵ#�a�.�`JwN��>i�{�@O3H��>A���%�t�$�f��(O�������5�E�ݯ����wbMȶGJ�(�黠k���bT���|7���S+� Z�*�U�!�|����Ϳ��z��S+bGY�U�g�BI4��d��������Y��D[��,t����q�`��ڌ�d%2.SX�܌Lj *�s��S��J���n59��͆����cκ�҂�b�w��7�8[̏W�I�{���)ˊNoO���0ǐg��,y^ӗ��_�( �b+ook�sqY������V�BG��u%�����oZ�=�S�����# ym�]�ʋ�r]8 �6������No�4$������*&���{�"��H��<���x� Nf:�WV�(�i��g֢���S�-��eX�|ɮ+BwA�{{-����N7xc����/��§3��̮$l����ſߧ/��[w�����3U�Ms3(����t�/Q:�|�}�-b��S�N���cR����'��I���in��4�T���`}i�C����=^6��[i�du<}#����r�|��,��KajD�t�*�I�,�y�z� ��T�^���b��ω@б���X����ٹ0:�(ݵ�ٔxj�qn n/�?p�lʥڣ����6��g*ԛ��2Ҝ �����QI �Z��[��=b��e^�t� Y���j�D,Z���[f�s �Ps��H˨7W0a�v<�$`���`�rP��9��ʋ�U���5�|��e}G�Wpe�0x`��?zh�Z�y�gWi�c')��)J��3�pYp�q�� 2����%Kaj8�Y��DL�|r������o4�Q�,�|�����-�!�L�E"���"��B�8zq�����$����($oH�/�)��˖WR%U�.�G?���.s-ˠ�ȳ��ڭ�HQdLy�78|�`�6�A�����$�����>����Sݜ&�J����j��#~�褌X��,�mo|C������%uX��v�M7%��F�|g�99I� �Iv�8���؈�F��Ă�^��b�S)�q���s3\V{Kt�I��J�n\o��&]�?t7y4 ���'����}���/��Q�-n2״�\�����g�p%�b6�����$:�x�%.�m7�|�Ov$�~O�\��+���E4>��ef��EZ~��6���q�}�MyZ� �� M|��4F�[o�j*��O����ԛx.�>� ����Vi]��TD��o��/-�z�fRo�����]qnX��l �2��*^����Ȑ���ߟ�%H$����C |.��Q��t�t��3���5�Y~-i�B���j-K�p�_��"Go�!���S�z��DͲ�e��`O�೪l9>ű��\�X�HuUA�>��r���j���(�9tT�ܲ����x��'� �'ۜ䭅�OZx�K���e%�QS�w@���驑W��{ ����U��%J���F.��֝@�E3t[m�#�z-�F��f��[�~�37���TR6 Dxo/:���P��1��2�&;��8F��\7����{�{�܇yF��+�p�������tky� ��Uf���ξ�kU'�)r߾p� ����&c}�Z&��@���¹�I[�;��=�zm7�������*��U,)z��X���f�z�C4�顼������V�(E[ʿR���Uy)V��c�/\�z� u���QЀ�p�J +/tE���jt���H�3/Ӯ�(�V�C��UeTs�TavĖt,����-�B��I*o , �E7����t~�D�sњP� Q����Sm6?Ӻ2�����d؊`�1ɪ,r�*�ȫ��9�=3�<������MUN_k�j�*�|�z*�z�&g�p�2,��E�\��[ʹkI�Yҩ��ɖ�_�*nT������HN����*e>2DL$� *��!׳{��>H�Q���8j���`_��{���!t�9�� ��>����%�8C��Ws#�0���Ը����/���%�wkj��u$�(��Eu�Y�ՙ�9_��H�[K��.�e謹��ZЄ�������?�m?Hv��4z�7=��� rl:2�-��� \ �gc���a�Y��H\t�9�P_di��,��2Hĝ�8�=w���xe
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20221111-en
General
-
Target
1.exe
-
Size
4.8MB
-
MD5
f2b54e147d818ab2d4ce1fec0552b9ed
-
SHA1
1a2e39b79781d4243071cb0de5d2f5a156fbc286
-
SHA256
bcd10b66fa799f9e1d9b5a72be1a140bd12b5b73962884d0c633f979ac536abe
-
SHA512
2d7a87df62537e5cc0c14d8bff7e7eaaa8d3536930667a9bff531a79377066db1c95dde3b54062d8821ffa38ebb4a65d7de330e15ac580fce252f0bbbf23fab0
-
SSDEEP
98304:YJn0jRZf2DagDHdBDU5YqWaN8Qd0dXCHi3GzV4X/:2Iq+SXaN8QadXCHOxX/
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
1.exe.exe windows x86
999b15da8651720076095a1bd5d80b00
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
CryptHashData
shell32
ShellExecuteW
crypt32
CryptBinaryToStringA
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ