Extracted

• • Target

    941955dbf8c27d4b0a6109093803ece9fff845ebc40edf2ac460f94a2bee7a34

  • Size

    258KB

  • MD5

    1ac5868848186c21f686e1da41dbd8d7

  • SHA1

    2580a12f170b77349e485e6b19525a60c94a28cc

  • SHA256

    941955dbf8c27d4b0a6109093803ece9fff845ebc40edf2ac460f94a2bee7a34

  • SHA512

    19c580f7efd1dc402e14a8280e949da39492b5fad0e14ebb2fe7ba8d59c4bc7c7115716c4d48e3709ff425d49076a0793be79bb419182a8c9388c5853bdd77bd

  • SSDEEP

    6144:ZKiLscZW7UrL9DRzh7MGkno2btxvccVQafIW6:ZK4naUrLNJZ+1bTvcxxj

  Score

  10^/10

  • Detects executables packed with VMProtect.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2