����j���ԍ� �\4%���|ϵd�Y����]��Q0�����D=���=�f�ϗ�ϱAi$}/������Vkl�A��8�I�w�+H �b�J�R�_�)\�a���+F� 4 B�3W���f��$����豂�_�p��␖n=lB���J�<�X��� ���"�y�%��\�+8�@+��KtD�9*U4CT��v,ΏQL�J"ue2����K!K�D��irbfv�o���Z�ц]]TA�9(�pN�+ׄh���:/����K ������"��zB�n�'� ]Cq�\}��f)P�/¦��6��aT��z���fô�U4�ȗ��)���PC���a;��E� �z���qXbȱ:��D��"�d$��|�Y ��eX�b��G=/����ހX���B�T�ފ��b <S��Į�h�k�K�[��h���>�]G�^=�e��^��],u��% ���}.I���i! �-���ay�������4-��tw` [7��Ԡ�3R�m�FF����$��8d\}�w��"���veĿ���l���b�g@�����/8�.�BNe���M��&#����zgo6�L�씾�;{�� ���8����ܻ$�|�$0��\�65-]� V�m/(p�P�%�>v\�N,��F�t�n����v�̙�Y����m����Tz+F]��0�p�5�\�U2$ݏ�,մ�B�IJp%�P| |����|>���EK}�N=��G��Ky�Jk���Q��¬������_���[\^!C�X��H<(��&O[n�6#��م���$HϹ�09�wq��5�I��MM�J[�� aS�"�2�]�o���cHƓ}6��X ����V[���9Dq�Fѽ5�J�tH������.�؟!�-+�9V�NN"���)���q� �t��D��_Ay�GA0�'!��h�@�&TLJ�=�(���lX�K�0�-,��Cug��K�f^ķ'�f�eu�����f���Zaw��;���ɏ\V�K�2k^��r���O< `}�W���/r?����X�\%2RXQ�)gp�F�hѨ� ����/<J�(��Ʈ}3��L�e�&x��5�KA<)�>�]�:�����M��I*5���.7UQ�UYQ�͕Q�����w��U�������EFr#yk�,�{���Xu����:���U���)"Z�0�k�ǺN����'�UT{�?���ͪ�� �G��e���^&:�_d��?� ��c��a�e�j��7 �+OFWJ���1J"�K$�ش�f(`b/\J v���A���P��rN~�s��\ ?v���W�l�\��s��o����7(�G��K�B���^r�KMCE?oɝSU��C$��0��lQ�#� �)��@gn�=������Jk����ܴW��O:4�3��(�%u}w-��3�`��)�twgby���ꟺ����R��s=�yRf �TɅ9���d�+�8mjG6j���\C6i '�q���.%��{J�l�dj�ͧ��Zp1Ži=����[�B^'}��x���J�T;Z0��uQ��ZHV'��n�$��.�I�7D4�>x%�J�&t\ ���+�B���[�V�?,���]��i郲�9X�Fe�HøaU�af�����[�ౚ��!��+��2�s�H�/l����m3�.�[�������X�"�wxB�d�#�w�wH8D�(�aQ)���{O��U;g��ڛLO���\&����l�����8WhZ��d��@V�a)��K�Z���G�d�(7Y~ze����B���eg�|���A�@+ǎW�s��p�;�CBM%} L5������Q.�&��� ��z�+��$=���y Oe�L���O�y���KΒ/A�l����KxE������� �^T� �>��X�������?�-��j~�����jRT��3�d���*�IB���� ��(F.�aW�����p2/[p��eɆC��b�w����Ia�[�:����^���?�_T=-�wIx�� }����'����j��0��[ޮ�Խ��ϒ�e���W y:8%��R&<�I�����xD�[�2��5eb7�Y���c-Z���7�ִ`��п��$�'��#'1,a�h�>� =����#�vN422�=0����M'�D_x����=fo�$+-� '��yV:ɨ���Wx`G�W�`X��GU` ���p��1<��{ƚ3�K�����̄��-j⸇R6�ĭ�9�=��� 3���K��m�_Õ�M��O����p��i���� I�gx�Y��]P�!������N��%�픅T�w'����=P�z� ���/���'�N��,[TT.���&��0rUS�����>R����2���M}A�@��|��a Xh�Y��2������G:���d���5���N����N�k�B���2�ҲE <��p*?���+���"�$����v���>@}�W\���ﷳ�d28� !\�!q�N�@ �Z�Ց����҉-yk�@U�݀���2��Bn���9�~��Տ]�k܇��g�$�^�Fm ή�k�2�e�a T�����-��eT��I{�ڿ�.�ſ�&��7d5��Z���֫�(�D�'A]F����>� �?�\R�,b�j������+����q�������ʞ,LX晭I���k{�LDp v`5��vp5�!�#V<Y�le3D��W� �x� ̓� ��N�R�i{�O �w���O[�q�ղhԢc/�0���q={]���"$��(M,� a�T���JB��ɒ� �;. iJ�ժ��"�O8�gc�:�t�c�v�B����6R�S����M���O�C�T����v/��X/+CXU3ƿ5H��s1��������|L��)������'�z�+lk���A��u1 ��� VI���5!�<�0�r�,ˎ��� ����8���g��P���Y�,k���6�$��&EBQ��%��}>��a�c/�H>y�:/ִ��U�שP��OA�Ђ�f�U���d��\�tf�0Q�y��L�8�.4�A�W4����ӡ'&<��2�k
Behavioral task
behavioral1
Sample
dfec62ef089effe330f8f3b0fbecd024e367ffb71f79821aaf318c99219ca9c7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dfec62ef089effe330f8f3b0fbecd024e367ffb71f79821aaf318c99219ca9c7.exe
Resource
win10v2004-20220812-en
General
-
Target
dfec62ef089effe330f8f3b0fbecd024e367ffb71f79821aaf318c99219ca9c7
-
Size
600KB
-
MD5
a5224d8c58454ac0119ac9f6c247d60e
-
SHA1
e9ec97b1c9e36089753bf1059dc25730b76531e5
-
SHA256
dfec62ef089effe330f8f3b0fbecd024e367ffb71f79821aaf318c99219ca9c7
-
SHA512
f08cd3018d722f94a81f399fa12c263983f7106604ae3910a85e2302c67eaf2a1da10717dbb0933452486aeff5808510759b420484466ce4e0313effd93edc1a
-
SSDEEP
6144:qnN/c8yBHCVf7L0rSAC8+3nz0b5QhOk6fT2XzrWscI:qndc8yBiVzLwjC8+3YGgr2XXn
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
dfec62ef089effe330f8f3b0fbecd024e367ffb71f79821aaf318c99219ca9c7.exe windows x86
f6ed5edb4753c1c9ec54579e52e55dde
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 304KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 132KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ