��X���(eA+�:�;ص���\��e����O`�·��s�|�)��Ӥ�%�aר����p��!N��1�*����N0��4�3���@�O��7���6*#�` ��R�h�1~A�������N��e�բ@mG�����& ѐU�3��І!O�Tn#�?���9 �*Un/�k n�;|���na�-�C<Q u��A�E�ABg*���2�J�Y^�A���M�K{�7G��o�#W�"J�$�tU�%)�7����媍����l��_Rǝ��P�����4��~I�;�n��W,�nɶ�|1<��<Uf��ze����R���N*s�����-���|�t�h3>g�w=:�QV����㢖0�E���_'J����|�������1�?�ܳXD�x���u#Csh&���nZ���u�i�����uf]��@�g"X=J�Pk��hYF���mȁm<��ds�i�oj!K 2��u��0YB~ޝ��:-�3iʍ��i���{��%ϣ���`�.α�`��'��dv��xFis%�͈�s��+�#�\T�9���,:/d5E��"���s-]%�E�/Z��U��YM���0��5F{�(��F)gK�cdj�(��.����;K��k�%54Ӫ�f�|���D�n{��������n�5���(Rg��}�? �ək�����L���ெ�٨ܶ� ���0�W42�s�%�t�0��h������##B!Ujt��QO���XB�u�ۼ�K���jqa��%~R�.��y�{���Q'ƞXՐ٧��MQu��|�"8N����ѶCz���"ƀ�gs̷,a-�� ����:$���Ti�M�7Ҩ)a��U���4��{���î�-ܫ��-��#�6`K,��0=>���K4Yݟ��ھ.[@&�I�N��~�l�&�,:��Z�g���.��o����0�(!�S�����~�&�!2��'���rEs��\�SH����#���F2�6A�*�,��FN���J�/�_Qz��*�� �v��93q[�Q�yT�i����\o� �W���p���ָ����(ۦ3�=�w�;���'+��ch�V��9U�����N$sJXA����U��9��x&�}b�?[ �R8U�=[��d��*��`!s梢Z�����)&O=&4V+njWFP��u�eod~sPc�����Gb6���.��kſ�X�X*4 3^��%��"��4���"��� �k���i�S�uAtk�����KV%���B�1�i��i�q|��������[�v� P�Oe�廴o�C��a�����-IqR�Q�Y��MTi�2Y�u|��g]),YI��14�Xn;B~��u��ƪ�C K��@-����=�w��,Ã�E����"#��b\���u)⸡�־��J����p��ئ"&���bOd�EG1��x��&q�1~�Z��B~�?Mt� �A�r��Q��"��<��9��� D���������F�4��!rф�����:;���{�e8-�r��h:1ro��T$�쉒8�BD��bΞ�����!LF2�2��W$*�-$�8P���C��-��.ğ�Akت�n�t^f^�����@s�ō�Cv��63� 3��~�8�[��;y�+��ؤ%�]!��"6Z^#e���[���k(UQ��7u���j����]��?�T�tjiT�sN�~���AL�R�80 �nw�)�;k�M����ze T��e�� '�S*�&c�J7R��W�O���bPS�Uyz<{vՉ,�NF:��Ù�k� sE��2���P�'�O�\�J��$��V_B#����ҕ �0�|�(U~dwn�o��^R�j��$�l�'ڣ�H���r����8�Р)�$�<�3H�匡2�ps,{ن��a:�gg��Z*����L�~�l����a��&��fK�Q?[E�ƪq%�S���S|���ϛ���i1��h�$S��E���gU�ȹ�Rg��N[^o_;��@ȫ�~��ا���X��mŸ��;�t����O���c�����Z[�i��,y ����j���?���^�̽ ��7r):�¾"�"�HɶIfp��n����,Ump��4=W�z9��",y�5VN�+�fد���9���̑�K�tޝ�k���}ߗS�v^|c�#�:@�)PJW�5s���u�L-9I��� Y����BBD+{�\+�o�~��@�%��S4'U�������Z��(��+�|d0y������,*ĭQu���f"�(�G�*��/`7�*w���#��(�,Wse}jJF��ۥ���"w}"���n0�({=Ђ�sfm�ZEh��o�3���E��� X��Ţ:p��w�V#�K�C��C&�@�� � ]�o���x�J����������φ��x:L�\�]|D*�D�G�v�6��dSh�H&/���Ǘ�F��/�T#�ދ\ �*_����<�yVy��f��Q,"�B��js����(�Di��;�T]:ī�t�UK�ۿ��Vh>%~�j}�N���`�A��X�t�I}V�&�e#���v�e߿���↴c/���5��̺�()������FU$�����@�8�d_"��ߚ����0����V�:2�`1��uQ���y`�s���M�l�u�l���gnN��u��G�l0#��%%�s���9rw���G��{��Y}2d�/�L��s�dظ���/�$`[%\�/���k� ϐ����B�-�2��w��}��<� d$��������@D�>��XȢ�T0X �he����)�� QM�&�1}Z�}uA�\�3�\����x�#�ċϧ%W��i����MԆ���k��ETP���Y��2 d�� V�LLZ6��k}�)H��s_�ohj��ī\�����������-��֯���i2������ir�ZwQʑQ*�O�8DQ��vl�㬋'�5�*Drz>�%����VyB��[昹�O��1%t� ��j�¿up��d�����\��������>\l��]�Ah��P_m��#\�Dưri| � f�"u#�_?��z(��H�
Behavioral task
behavioral1
Sample
653255d5f2986a5bdd8dc6ba6c5d63296e0d63b56b83dc231e7fca35ce3ca69f.exe
Resource
win7-20230220-en
General
-
Target
653255d5f2986a5bdd8dc6ba6c5d63296e0d63b56b83dc231e7fca35ce3ca69f
-
Size
2.9MB
-
MD5
bc13ca321e2156428860fda094135814
-
SHA1
4ca4b64670385f46b5d1bc896b2e2864d7e1c06b
-
SHA256
653255d5f2986a5bdd8dc6ba6c5d63296e0d63b56b83dc231e7fca35ce3ca69f
-
SHA512
dfcf650eeeeab25ee216dfd0b67d86ea813ba1dbd74960e0a687d36ca5af000fc8a98624f41f6d45f602a980a410dfa13a750969765477912dd63e07f89a7a7a
-
SSDEEP
49152:kbQgxEQr9dDQeA35BK5gleAGnWwVEd4u0OFoK0jhNbWyKt1IvfwEkAUXN4E:jgxn9aSMwVQB0OaKmNqDt1IVkDd
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
653255d5f2986a5bdd8dc6ba6c5d63296e0d63b56b83dc231e7fca35ce3ca69f.exe windows x86
83ebdd0e287c203bd31c71c02647f1ca
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
winmm
waveOutOpen
ws2_32
ntohl
kernel32
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendDlgItemMessageA
gdi32
PatBlt
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
DragAcceptFiles
ole32
OleRun
oleaut32
LoadTypeLi
comctl32
ord17
wininet
HttpQueryInfoA
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 911KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ