�\�GL��'�s�#�V�RF��W;��|j64)_y�>���ѧ6J�R�m�M�{����$���|�bRMf<���y��r�г�IӘ��^:��G���ӹ��K)s�L�'/����Id:��$�z�F����{o��h}�s���Ӊ���"f� )H>Z�;�,e�6��N�R�|AMo& �.\��r�mn��h�x�.��#Ϣ���h.��1����Y��V��ʙ�y��zMph�~$3jPp,�3�E�m�@�z�~{+��x�R��Ʉ���0���_����$s�)o��DC�KG����%��i��v�M������C�Ʀ�n+� �J �BQVs�S���D�&&���Q��J��Ƚ��̓��W/5����7�.�������#�:kȨ�!��_�Q2�@%�<n��ǖ����%��X0S�$ �#W����I2�kF�Y*' ��eY�����w7�����F^�Q���t���~1ɝ݊u]A�o�uӋhTN�@�Aj�1�H3����[xP��^��H(��F8�[���?��{n�AViu��%{�h,=�v�\�$f�v~X~�3H5D���l�o�M*��*w����@�돩l6�o{Խ���A��3��7��=:���l��������lFy뗤(�,�!!�ȏ��Id�����Zd�)73�Ax�s/e�B�1�9.oB�T�t��#� ��b��[B���d|�@��u C����b��{p�5������l����M�q�˝SGIz5����t?�B'�&�0��X�P��ِ����b��(��Om^���{�� ܔzj �L9�;�v�9��Et�+�t��՞AQ�2�[nor�/�br^��e��G�ԓ@H��EzH� �?��C�#�#A����E�f}&�I/�#0'G�XU�!��G�B�Ziz���L̟�(�PO�[��Z�5&��;�r�z��ʣ�~���J�p/�2ٓ2Y���c�J}�U��!��Cd7�$��kMn��������Mﻖw0[��Q�HL�#m��F��y���j�v;� �:t�z& s��ݕ�/=��@��`w��? �U�&���5Ƶ|�N�������z.���ۏ��PJ���j&0��.y_m��0)ɳ^�z��E�z�77�AS����0�?[UŻ^���,?��k��ㄞ�h�"{��em��H+<��q_�A��RT�An�J^}Lx�6�d���w�9Qg���>C*���y]���t��$7�l6Ô����pe8"��b]�fY�?XM��dM���1�8�mS[/�E ������c�����.�X�����G_|�Ԍ`��vA�a���h5��y0?��)��>Y�R�V6�r�a�_-~����ⵕ&��\�Z �Q�C���_Y덁N�T�'��a��$�z��Z�qK���C�Q�V^+6]E$�eS ����E��c=\k�YR��r�Y�����oFx�����c +���*>��U��*f���Z~�"�B�~��=�ҞO}Hb����gxN��_U2u�3Q���/�Ba�w��Y��\���E �g�ZL��&��!(e>��eJ��WE�3�R�Yh�}b!�7����U^c�*� �`�T\$��:�r��m�+"�4hB�W�y!���f!O�� ���Q�1�W_B��u{]��WV2ȡ���Y2�~ٮA��Cl\�`�v@����]����C�&d�P��b��:�}�N����Q��ξ�ÅJ+�vm� ���������Q���UŹFF����/�/@��i�O`�N����i�����X[��",�i��Cv�o��>'n��凩�{��|/�P��W�М��i��� C �|����(������Ƭ]8��n��v�6�`���Lb�}CT �a��� OB�����N��j�_�uj%*�E�Sa����J�M�i��~��jj�V�m[o�:���*��E�m^E>����1��䚋��I7k��>~w����tu��kҗ��p;�ms�̍<MX��Pt]ߔ�l@ ���]��f�k��N7��M����eFA��-s�*{#������O����31Bx�S#���GX�+�V�lD2yO���P�7D��=E��Yz8��zK��{��=�s)��E�U�Y�8Z8:Ǹ�F�,v��&ė ��$�h27"C��k�F�I���Y _�V{�e��;@=g��}�j��� �������E����/e"�@����v�R �!��(_8�W��8�v���Uj_$'�{���1�qH/V_b�ްx��&Y���:�9�s��Ś�E�˅<������0=|&4+�UA�{W>U��Qt=�F�;���\�v�zx t�W�2vqCC��\�"�mȄddm1���*� �Ś"Z��=&�_=����d?�ԡO���qcU6�`��_x�H=hN4��ĉ�����D���8��Hv,#�I68�����"_�}-�wU���ƹT�v���O�*. 5�GՉ{����^�y7E]ìL��o�u��u�e'F�t�;i!��Ü�����)UG^o=�������u�K��3�����_A���~/X�IϠ�]U�bXEb� �� 5[��ؽ�� �h����i�(�̑�f���|j�a�a�Fv�� U�������Hb��.�����N���3�����c[pzx�A���2��<2*_� ���mU�6�}��{���Y�&WI�V��u��1�3p1e��O]'�1ق�1Rzp5��b�A8=Z����JX���!��c�ʯ�ّ�%Ӛ���-��1Z*��<����L�� �>�6k:���s,��ƈ4)���>�v @y�E ���Q��t��pz`p��ȿ�<�l�Ψ�+�ˤX9W���ņ���� �]X �.�'o;b�{,���G�p��j폄��^p��a�~�sW7� j����϶�����l'�Ip�C:��])�q���D���@�u���-�F.�%2@33��N@S$;�>��3 ���ۨn����ՄHG��]�6W�%��+�踦��HR`7�|q�����y�� ��1�&%0��߭�j��`�4�E�����)�
Behavioral task
behavioral1
Sample
b07be7c8dc7bd7209ed1dd747a46ea6386b5963660c753a328b38017c708a1a5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b07be7c8dc7bd7209ed1dd747a46ea6386b5963660c753a328b38017c708a1a5.exe
Resource
win10v2004-20221111-en
General
-
Target
b07be7c8dc7bd7209ed1dd747a46ea6386b5963660c753a328b38017c708a1a5
-
Size
1.9MB
-
MD5
2d8d44d08c0ea7f8ded55aa03700c614
-
SHA1
e10e02c28981555a03b77f27c1996e92efefce2a
-
SHA256
b07be7c8dc7bd7209ed1dd747a46ea6386b5963660c753a328b38017c708a1a5
-
SHA512
1a44e4ed54458b35116d8bc0c3b6eb1da7c093ca10d81b41d796a1488d18f029da2ddad3f48fd0ff835673ef5ad6fb9cce88db7b9da3e2b355abcf2e153c01fc
-
SSDEEP
49152:fkCYIZxnRIzgNUklj3qZJ4eMbbkvu4HXqak5RH:c/ITeEFljC4dgq15
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
b07be7c8dc7bd7209ed1dd747a46ea6386b5963660c753a328b38017c708a1a5.exe windows x86
f055f222e7ddd7e9854e2b8482d99576
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutUnprepareHeader
ws2_32
WSAAsyncSelect
kernel32
GlobalLock
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawIconEx
gdi32
CreateSolidBrush
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Read
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 821KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 353KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ