��T���%K�UU| ��L����6>���6�����{Uڀ�^�=�Պ˶�؊wǔ2E�� �����4����X��w�T�ok����H�q�L�u ���AK��E�1�l�a����3�*�S��&���ls����#�Oֻ;_A����Y�ru�l&x��� N�D�V��s{�A��F5�٣��Ҳ'����M��*E��/Y9ѩ%D���/vs�Hp��^��{/�uNw���qÆ(�ig�5>� 0Dy6^,����P�-Q�� h��?��6�Ϋ�{�ugA��S���� : �9k�b�5 e��z�ש�?d��;����r�Z���Q�.4C�}�KIkO�"5|;���*S�Dq�>ǗIA��_���ڨMl��"u��)nͽ1���xn�$�.�����~��]M>�n���S�Q`=W���8���?�뗓�nY��*t<��2fB��i�a*��^%�?p���t�<��%�Ă�����A4����?PL�W>b�ae/`4~�4�I*l��I��;�`ME��Dn�Օ����vŨ�_�N8�ܮF�^-1+UD������!j�ʤ��`SyuP�w�������\t�(,X~J#E��K��1��N��(�����>���_�`/$\���_�+>�����-�s�/I�U�~ق��L�W�<��`s�~�*��a~K����JX�҄��\��&8) �c!+�C`c�ٴ�D�QlP��Y�q[���D����|�=�S3�e��: Y�0>`7��>_�8{�s]Gw���YS��P��b!��+kɃ ���6���Jm���!1��$����\ �2HY:���r��M�d�b�d]�ev�t�҇s�pC�:���+�j����Y\G2��-8��i���W�T��]R=�eRH��< �F�����н����sr����8���2�*Z��(7�()sQc@�����P����ԕ9�:�r�0^ޞ;���6E]CɄG��_͡+�Kt�����b���x�y�VdS��(��g����n��2�W��8�j����+(_��) ��!�6ڇ$H ^���NM��NK�j���bD�+ڣ���D�HR[���ߨ��vIgi/�_��d��]qLL��5����ix ������$`����9Ѐ��bݵ)UM6f ��<XkM�[5�QXd��G.�M��' �5g<�;K�BP�u+au>���r,�^�|74MC��9�}������`�n�[_����ظ�^-e_��ڒ��n8k�&�5{�!��\���pV��7�)q4�S_�G ��T|��&�Dj� A�S�(в=��"�����E�v�o�_���ƻق��@mFK��|ԁ\�xW?O�9=b��n�mH����Oa S�\=��|�p�3�+�-@������b��Rp�z��ӣM4q�E�`\�9s��[G?�))���C܍�s�z+��"V[ˣ�m>��19w���9�ؚ8*Й�e:w�k�x(��4��� �3�'�5����=���NN�tځ�ٞ)������0���q1����^�0#�����9"��2��OI�Lyv��Q� �JN~JO��9T���\��ry�Xk~���i���+�/=�&�@}�`�gYߗ��`�Q���*�&^�v���m�O�5����)au7v`؉�FCBG7���K���d)������rگ�ja�FYF�C��ey��з�������B�]U�U5���3푥ʼn�î~�{ɯ��1�����:�g���1����4Q��ٙ���I����@� in��F���Oj�����`m�mN2zrEQ��Eى���,oT��r���~����ӿ]$�+Ui��M�BNK�Lu�?���������W��=s�"��p��,�Z�ki�!�16(�ֵk*�P�$�<��⃦���4p]�z�����*e�u ��� 7T���3���Q#���C�`�cwN�S�2\/�>����t���R�+��cR�;*��+̻F���Lz˃��T�B9��?�S�A��gQ��M��F�e�C�$��os��I�⡌��I�%C�f~��ai�y��G��{�P�N�?V�O]�S�W�(��0bz8@O*KK �|ɳ���р�k9kF�hAH�m��EO^W����?ۡFN��,��\B71?�MK���gOQ�@+z����M��(��A<"�����(i.J����U���ř��^�>��kފ��ӄ�qh�h�:a���� h<�Ò��� ���C�_'߮+:�z���[�"�>��������t�4�,��سww��^��_J6qx�X3�<9�R������T ����2��Z�%���+.g�JX/�,x�؎��K]�ɃG��7� ���uG���(���;i�'����q�<����_�(���Ī��-���Q�uA��oG]�XHT��}E)��`�-Y�6�=F�Ύ0�V}�eIJ�{�u��N��%�J�,h:NZ���V����&��*�z|��j\?�[���4�2��z�������G�F�c��H��,4��*��/�X�>������E(�}5�)?oi���Z�9jz��2��� x�^y�� >���/��6���u2i�&a�I϶�s��pBi��i�$6����B�D�Gn���Q$퍫9}?�3�V���R��z{�CIR"�*o[��BrIhK�0� ?��y�U1�C�@%�������L"��o;HN��e�������vl]�/��_�ų=w���3ZC>�M�3f����)�f�s�����ڦeS�`^*?;`J�<³{%uk)Ē7��M�iMU�l{8D�{�h70��*<��E�%eG��{Q�_Gox<���x~�nA?1j�Z:Vs��y�Mg`� }bh��Z]���w����:�dx���p@5F*Of�%��Y>��}�n�ZZ���I81�C�����N-�;��ħ�G��j����!s�� bZ&��aX24Ǡw��07��}ƀ����P� �n��0�O�WY�1b��v����=�y�Q�3���I1$E��uDS��G���4�@��� �ԓ#y6��2w$�U��v�GZO-�6/.��
Behavioral task
behavioral1
Sample
015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe
Resource
win10v2004-20230220-en
General
-
Target
015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9
-
Size
5.7MB
-
MD5
06d51eba5329714f34565ff6be36f525
-
SHA1
47bb5130d05bcbd9551fbcd0aff303f4ac5074f2
-
SHA256
015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9
-
SHA512
1f4c026d7cb099911c9d31b2ff35ff562c5a84f5e54b35869355d1b4c23d2b9ae1de5c1b564575f457c8a10479108c40c94ff9016ecb0c7cae27b286877388cd
-
SSDEEP
98304:y0j1Ij9ZLj7kTVOV3lXLeUcq1cM4DoctB/pUc+crheufhqb0oWnybXEnumqTwQnK:y0jahZQZO9hLeUcq74DoCN+crtMwnuml
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
015ec8a7dc343e6d1aabb593e77a894b23f44cc2c7d5eec0de03c3620a938cf9.exe windows x86
3864df12b3c39c8854b7409eae8cec92
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
iphlpapi
GetAdaptersInfo
winmm
waveOutOpen
ws2_32
WSAStartup
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
keybd_event
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ExcludeClipRect
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoGetClassObject
oleaut32
SafeArrayUnaccessData
comctl32
ImageList_GetIcon
oledlg
ord8
wininet
InternetCanonicalizeUrlA
comdlg32
GetOpenFileNameA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1005KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 895KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ