&�IU���L6ī1ZT� �!A��^������w���R����l��'4�?��4�85u����� q�|47ɨ0����x��!���#v'hp v��k���P�X�yfξ0���ăd_�5f|e-��a����Kşp5ֵ-�,������Q��-���n�/��$.�Fc�O!���'b\�j,�69'(-L˃H��c�ΰ6�}�<�}��}�H�^��b]3x����Bp��(����hCğ��Ia��x��0���R���:�=|�2��)�w�2���xPG�����y ā�!Ȅ@�HqN��W̧�)ZC�h�}�s�����H�i[N�/� ��-���Nb����3��4��UNa�6.c#Hf%.O>x�H�F�yT{p���R��$�����B՟Nl#ă��Q�fr��w�EMFꚞ�x����6��BHh�1nDNu>�wp`���u,$�Bܡ�3!�b05�F"��/껬��ݯN�A-萺ҁ�����\#���%��9��#L�%mg�n5�G�LV������e4�"S��J���>n�\2���>Ns�N��U �JR\0�)��2�hֹ��vA�L��j�}�5h�T)������#��O=)R)VLm�5����~xV[�� �� }���p ����2��F%gb{�s�4��#UƐ% �m��f�t,�D]W��&�lCmOEf&�.�YT9_��`��R�����M�����J�F�(�;���|Rq��(. �3�PL�e/��Ҋ�r�K*<s<>Mv>��,����;��qegB��v3��P\���b��m+���ƔF�47H|�/Ʊ�ejUR4��[̮��MoC+ͺ�?���6ȍ�ʇ���o~��zM��kn3����������F����N��K���&ջM���QN��t��wB���x!�ފ[�G�y����wJp�� F����v�|vrdt>�t&眒�n���w� U\��h�����IG>oXvy�J����OjeDm��^rI��a۵m���7������ƞ��XG�SBc� "�q�&�[�y�n���� ��s�� �IFo��T�� ����t'�e��&b�^��A��e����A�֨��5IRz.{p������1�N�a�� �6�cQ���D�7F��9����T/�Z&�"|(���%������z tb�[�LoK�(�����J�-|� ur�D�N����*H�k�3��J2��X�A�ӏH�<mh�OD,���w�ƨ�z���Og�9�T7��l�I����*�X�+��1vn��&�J���% ���pp`�V�J����p�z���˕�`u'������g�����NJ�9�������)~�y��Vy��� mo��M��t������邎-�k��~�_m���R�����i�͙K}0dnl�g��[H�}�3ʫ�9��W^��,1�L��"�҈�Iq�ܩ�l|/������Q~�_3'�����s�͘»vL�����'�h(`��Ym���Wjْ봇�ĩ��}�������ٮ�1��H��猉4�K�'���>jo�-�Y�S�Z8�ӧ�������C^�O+UI�x���;4�}9�\�䵰�`(��mD��&�F���-d��u 6�����Ȣ�6�V{8F��� iF�вu�//f��͎��e���,[�hj����%��4]&D�G~�`����"U�����r��ث���1��`�2�<��T��:�bh~%�iŔ��i��ȼA�a��� �!� �g|����3�y�N������>wJ*�#P��&`� 8�'c�R5���c��w�F8<_iz�]��,{;2V��~EM�}B��Iڳ{^3��?`�F�7�D�uHzd� Z�H�w~j_L��o^{�:�(�?�Ά�Q�V@m���zp������F�Y-v�WG ,����E��:�Ɏ#�s�eM��Ns��E�_:�w� g��0��h� ��u�ƈ���@�4��N~#�ʸ�u�e\��ɔ��,N��m������� k��v���<��|J�xe��91|?U�������dU���_�S_��� kl��۵n>/��(*:8��m �bNN� Ҫ��NA���4�Vs�!E�-�� ��}R��K�s`��j�䂢E|u�u(��h;���|��`���� ��fۢ��v�gY��]�!#�4��CL�(�����UQ�o4b�W.��R���ŧ�p���܅�\bʴ�in�㰪��~Ψ)���c��5c���% �.�@p���Z��$zC�����ՠ���)������=��i8mh O���!W�`2���� K����d ;f�:�F��Dl���īd�d������V�����+�m��geCKz�@]C�����mU�u� �ル|���E�'����I�s>�'-�~��녞����o�5��4%�?�sR,(����垭2�d>�!j`�vc%B9��N�������~U�{w��L�����d����3��1KU�j�����}W�Y�+=����B-N^��*F��D�VvN�2x8�@���A0e�Q�Gj���Z*�aS����\B8yh!��V�n���zUrf!.������`0��+Z2���I�D�O�f{x�n� Un�����zJ8w��s�Ǜ�4� ��N�@�V-V����j�h���^[��*~1��y]��!�ê��T�J�J����ݝ��Nr�y|%�E���9�NO�� #�`2� x���b��K* �_p:�C��֦J��^�-̋����@P���Y����@祓� �k�RU,����,�.2��,�E/��{J&J���5ήe�7��"�\��#�*G����ڏ��W�M��"#�����Q����ۻ��YpoW�[Bw�h�Q�g}�EP���\��KO+�k]�6f�.��q9#3�}-]�:�������#��u���R�ь�18�@}�����-��k�t���@(quB����4�'b�{h��?IO���0,1V�v�N�\uW��H�)���"�j�kl�vӔ:>E-S�⠙��#L]u�e�Q��u��g�@)v�6���$V�
Behavioral task
behavioral1
Sample
8c10b47073b16a9bcd6dd9750479901efeefb85a96b14c1301ca18bc8a3192b1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8c10b47073b16a9bcd6dd9750479901efeefb85a96b14c1301ca18bc8a3192b1.exe
Resource
win10v2004-20220812-en
General
-
Target
8c10b47073b16a9bcd6dd9750479901efeefb85a96b14c1301ca18bc8a3192b1
-
Size
756KB
-
MD5
a95524e4724a1e062743c80b6e76e804
-
SHA1
b939e0a87bb64ab82d1d5c069eef7fd4cd9039e0
-
SHA256
8c10b47073b16a9bcd6dd9750479901efeefb85a96b14c1301ca18bc8a3192b1
-
SHA512
e2fcbcbf8f3948ea6b1fe4296603c72ea6fd96c8873855d9c2df844f199336fc28bcda78ca0fb9bcd76e6fca4f403289751666c6180e61817ae61e66116f9b38
-
SSDEEP
12288:2rth/MHAX4zQAMNt4027mSchMW/KYcblvvWK4a2ElOgPyai4:mL/MgX4zVMA02qSdbxvWKsN4
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
8c10b47073b16a9bcd6dd9750479901efeefb85a96b14c1301ca18bc8a3192b1.exe windows x86
98efb23b37bc10cb44c90880594173a5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord645
kernel32
CompareStringW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
Exports
Exports
Sections
.text Size: - Virtual size: 345KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 577KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 736KB - Virtual size: 733KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ