[[3mm�>��̄�:u<�-� <����m( i��p0�qY>21�)w��b��|�А��b:��D3��\�>6s�������� @ ��b.-�}�|%���<VU�\ҫ̄궬�Ip�����X���a��\����2|I|�U�|�"r���Z������p/P[���1 @ \�(�h�;D���s��HB����6|N|���M����q�|}����!C�F�t��q�i�R�+�7i���,��\�I���Y=��:m��C�8 ���2����Y�ykH c��,��/������b1����+��ݰr��h�O߬wBx_�,#cꡤ0s>� &��(mÛh�qؙ�U�1]c,ք��������%`��@ �@q� I#3GKGNN33�� l�0"�5�v�z}@|��-M�����sz�{�q���\c����.p7�t�����n����c�e��A�Z�4������#�x,���I��������v�������o��1�k�=��Ō7�T���[]�g=�E:|��c�(Pi��!yx�%<���b�>�*��ӡ�X��$5�������+�ks��Hzb?)�wķҿ'�I�q��A؏��F��� J!q���'�)7I:��k���,[�������C����d������3a~��b-��ͼ�87x�ο��3Lf��+���u^>���|��n���\w Қ�vLc�e{R<��%�<��켷*�g�X>y�KDu���C�8�j����Y��>x�q���1,3�UyNd���%x[oC��ls�)�U�,0�ò�:2ngh�K���`���M^d-����t��=��D.������-?�7Z6eX����i7�kVO�VRw973���t�ޚ����s��I�����]�X�?:X�blC]�6��1��'��yڛ���N+�|N2�1�P���<I��ᄾ�E�ӊ��b����`v=J��.u��P�#Z,��ּOnSOMp/�So�+7�b@2Zϣ�wK/7�����5TO���8b��B��/�r��7I���ַtʰ4_��HD!�trAh�}2�1��՝0f7h*�!�� m�2\��6]�ף�v\�#��1��à�oAI��Z�A��x��!0�e?������[KAF���+�?`gYϫ�zYb' �6�!�d�^�LjcNn�5�h:���dD�;�˫DO}]�۟�(���Z�2�� �]���-�,�w�M�?�@�>6�����O[h�.��6�*T["1I<�`I w8N.�?w��#�X�`�Z�֥���b��:G\��,V���U�<솧}Ȕ���~zb*��_Гk���J��"��oX�i� 8U���7�;.!L6��*I�Bc��U�5����=��&�F�C[\�J�[d�ay�@�c�}���cI���S+p���@�M:������{n?/Ek?����v���/� r�o�&!�=b��v]��6��,Մ"��̠rnf���ᄯ��I�T�}I������x.�[��z-�LA�/�0����� W��W�� �R{��J�@y��V!�t�>!"����(��d�%�D">�G82b�C2�Iؕ �:��:␦tT2ɥQ�h�����:�!]��y-�6ԕƮ^�O�dl�{7��s�:� <t�Dj^3D�l�>���gBH�M�V ���m���� �*+^l�������d^� "٪����Ҿ�B��}�J3=-x����r8��,ˊ����Z�'�me8�@ ^�O�A����6�oib�p�c��������Gg�[kϣ�wj���H5����vM�x�)�zh��\�@�X�;��<�ւf�T��{�o6�nK&�3�����V��7y�@�5��T�==��d�E�8�|�����6��^DI ]sFL������d��]�S�BK�Lʌu�������#�9X��닷}�d�?cM���ړ�-��6k9qӆ,U^���� �,i7K/�15��X�k�*�&,�U�6�+}�M�LJ�I���4Xi���P��E�p��q9��A��� �9��z��տ,���o�x9BK\|�7�y07q3��~\8�pًNYp��uΠ��.��"�R��\%N?CH���VQ�G��N�4���Q)��?���|N9����5�i��x5�G��>3��T�n(�����N�r�9�]_��F�m��Tל?��J��[��K�f���J��E��^�U,��E.�.�2�//:�ޱ,��u���V iY�9�* � � 5�?� ���IZ�R�Lp�B�����Th^�V}�M���H��9`����6��m�g�b �^� nяx�y ��c�1p��7�-�e��'����y@QZ}�brv'����:E�W@(rfl�����\�;4{��*y�U�s�.u��@�).��c�2>���]f�C�OC��aC��=w[�=�E��Z\i:,|�ǯ� ue}@� ;q6'x�����O����/���;JP[�����e3�n�@�_����D >�I�]�8c��V)H8�j�wZv�{�9^\����{An�vt��f���h�v@�1SxDF��ɱU��8��kʁ5ڛ en�k�g���M�p�q� �η������/=0熯�JiΈI�� �F�_}>G�����gssR7���T���l� /���Z��t���]0�g�W#�A=zs����֬�(�g���?����u�A��8�� ��v���������0ءN бP��ڲ�b�!�x�q���h��z�p�N6�k�^���D2�7��{��x't�4�c� ʊ����� �]�τSGVW�a*��Y����(�x�MM�<=�S�ך�\����љ����J�+>���b=�{U���Le�!��O߈{�|�TP��3u��_G[�.LG�^,��8>�=R�4��|g���Y�p}Λ,5ȡ̯��i��* � ��IN�����jϖ2fw=@1�)�=�K���s7�i__6�����G��}�͈��*F�p§�A�����9�`ں�*g�m-�.$���ңϵ8x��"d^q3Ͱ6����~���.̴-�E�w����A��?c-�������^*�b�
Behavioral task
behavioral1
Sample
de17a27d2b282818f7c46e23ca16d7c98c9a3864886442babfdd0e083d669b1b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
de17a27d2b282818f7c46e23ca16d7c98c9a3864886442babfdd0e083d669b1b.exe
Resource
win10v2004-20230220-en
General
-
Target
de17a27d2b282818f7c46e23ca16d7c98c9a3864886442babfdd0e083d669b1b
-
Size
4.9MB
-
MD5
eece008e621c8addb2a8b898c9beebcd
-
SHA1
5838cb462296d10f0b40f7e86df66e22b21d4dda
-
SHA256
de17a27d2b282818f7c46e23ca16d7c98c9a3864886442babfdd0e083d669b1b
-
SHA512
98974a846f462aa4cf0d6fb84a388412595a59978a044ee459a591a74098ba8138bd4e8447ecb9be7ebd74ecda3140c05cf62274ece9a8c30696a0825bf9e858
-
SSDEEP
98304:LeuVrPypgtWiAv3o0+8KBC05/23aUOPYnrABTAXzktbu2NPxltz4g:LeuVrPJ5AgF8QC05/pYcBTAXzkt62Fxj
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
de17a27d2b282818f7c46e23ca16d7c98c9a3864886442babfdd0e083d669b1b.exe windows x64
128264abee8b343e85debedb28b6d41c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
cpprest141_2_10
?GET@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
shlwapi
PathRemoveFileSpecA
libcrypto-3-x64
EVP_CIPHER_CTX_free
kernel32
GetCurrentProcessId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCloseKey
msvcp140
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-string-l1-1-0
strtok
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ