�\��6��u���3�o��°".P�kD�r��kq��]�߀�$E�G�q*�/w��<�+�S���EvW�/BU���O�a�0����**�F�$��s_ô B��}DGUf�A��׃3���e�2�:�,Ĉ� D����uw�{� �W���{�hW?��6 ��]7��Ci�/�� Z�0Ŝ+��>���7̕��a�EAfY'Oa��4&G��g�Wq�����dyУȘx�y�a��t1\4�c�{�� ��m�Vx^�1Y�(aB��L;� rbU*M�kh�v6�6��5��t�Ӯ���O�� ��AG�Y=��b���o:8d�*�ɜ��/��uԪ��� �p������Z ���*JQ��DE��w�}���y����wD���w��G�lV�*[W,���u��BA�e4g������� AS��f������(�����;"��{��-ɮɱpe,�����l�Mi�t��l=5G��F��C�Zn �U���r�D�gMY'WL���ڢ��(���ܤ��+b����܀�Y]�6I��h)(����T�l='�����B�9R�hÛ����2��1��_N������6�N���ɼd�+�)�w�9qd�>D+;���GءCx�U�.�Wor߈Qվv�;o4�\gw�ڨuUj�)v��+I�==\Z��ļ�7��J��q�� δIX�m����*�)1�g�*�.�+J;�/���EK2u�0�l�!oK�k)9d���y/��'E�"�-�X��P�������/��͆�z+�qi#�֥���>���;�8Ⅳ =A��&�k,G/�b�3AV~!�W!5J��c��Vw���O%�{-�5A��of���k�kw)�@������TPnaq�V�ڧ% 3/� <��#��#�<SAj)�yࣾ�/�$[8�Z��R���F� *�˲�#���|��^�R{6��O>֗M~,��R��������D�wIJ;j���g7���:��3ƀ "!���]ʣ*j��Vv����\� .߃|����H~7D+~opAFO��"�3��LF��e]�A���y�L�f �K ��#"�F��9���#)�,�����+{�.�i����}kt[l!Y� �`0�gP9K�A��b�b����*�5}b'��D�]����[�Dw�[t��0�����"�8��1R˝^^CR) �c�z�v�a�v��S���L���r\_m�iU�����(7 s�l��a}��3���,�u;��dL��[=�UJ�Ckv�O�4�Ii����"�S�9F ��� ��7�E,��}�(6z���Jͪ!�P`����r��(tGD �p��^���M�Hӵ~�k�w�C������ܬ��cO���͊)J��c�0|DK▫:��_�?@�6њ�p�������P�$K�+�SP���o�-\��e���`ޗ�tE`� y�,)od?S3.�B�@{�'�&���`W0]���I?���Q�$"��:����S�OΓ/X!�XJ�J���� �6N�PVu|ց�"h!���wg)� :��7�}�[}��BM^��mT �/����A��zCSğTT���ڏ}OC�%�M������� �j�֫���)!�Y����4`��>��p����Ƥ��7�/O;P��Z�,B�i �i^�J]ONS�K� p>dӛ���W�?tw�`���hD���T��Y@�2DZc�� ���7~pE>l��2������c�X �ܪ���B߬��� e��>˚L�@ެiu�epa�(Mb�&�W��8G�zk�p!��+�~�B:�]��tf�W�Is�}��� ��@ý���*Z��^l��Կ;� O��6���5��Y۞�,;&ڢ��h�Ӷ<*GY�h�AF%��� ���-f���_/�͝�A]eA�fop�)�/EA����|#�J�0�` j��f Z���gH&����!�uNu�qZʦ���}� D�}��0���j�_(��1����c���Lv�'�״F���P=�L�L���;��d����o;��.�0�����lx���<�bL��34S���#�r�����Vyu�b-揰rY*�.���r~���, ���a&�!���{oZ�6~>k)K��x�߁ S��ڄaq�����t�A��㏖<J���}�OQ��*�mEf �jy5Ťs�"#|�<jk�B~����;2(�&�������cD��M:�*��+0A���'kU9��c�LK�, �J���n݂P*�^pˈ�Q�z����]��*ק��$� �+_����:��U#��úd#��ˉF�JZ����0����KX66ѥ��> � ��`��*��B�QX�=���^9[�ԙP� ]XK��$P^Iq�+�� R�f����c����ƍ�;���^9�R��5���iK�w���� z�B�6�08Y� ��v��1�I!3Z�?o9v�F�I�u8�e����T�������[���Ej�.,5 eg�p�����8��3�UD�%�) \�Ox��� k�l�&4n2a4n�t�t�#YO|�n��W��7i��.����'��˖ޝ�c�Y��Z������A�ᗩ�p�_��6ۇw�\��m)`ei�_�K:���:no��W���e[wN���HL%�g �CY���GCD$��C����F��c.$��2JKk�&�̷ 8*���C���.PE���wV��z ����H�4���z��E㗻��� 9���ל|�����K )���d�֗���]����C� �z�s�zp��^&��g�@��b��F˔�lG`vQ� 6߲� b��B~�;hG���K��K�UG��rv}"����=�+�+cj�D硓f��U���筑+��*��n\T�|����X>1c{�は�y��~����&��4�����z9�ɤ^2*��'���B������Uj�q���.���B���5u*l!�XY�J�g�t9of+p�by�+n;���5hC�g�u�B+���c7�� ��r�nP��g�[}���fb���[nO��p�H-��Agq�� ��v-Wo4H��A�
Behavioral task
behavioral1
Sample
3a2469fac36fb1a0b834a28f9a246f796ae8ea8dd29ad5ffd06cddfc0216854b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3a2469fac36fb1a0b834a28f9a246f796ae8ea8dd29ad5ffd06cddfc0216854b.exe
Resource
win10v2004-20220812-en
General
-
Target
3a2469fac36fb1a0b834a28f9a246f796ae8ea8dd29ad5ffd06cddfc0216854b
-
Size
628KB
-
MD5
6beebe243202c60a78b0dbfda6928880
-
SHA1
d0b8e201dcf7c03582d4189c972c2e565ace4cc9
-
SHA256
3a2469fac36fb1a0b834a28f9a246f796ae8ea8dd29ad5ffd06cddfc0216854b
-
SHA512
3dbe811c71eb92bb494a301e39b55dc319d2eaa3f0a9514c73801ac048c7452f0dbf0f942fa177fa5e80464a5ac2c6d81f6c21470c9d704028ac71ba5df0f88e
-
SSDEEP
12288:Xt04zbis3aCmxeKDjFGR5UevWe6uE7EvauDoHxen:XtnjaYKDj4RN8uE7Eni4
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
3a2469fac36fb1a0b834a28f9a246f796ae8ea8dd29ad5ffd06cddfc0216854b.exe windows x86
f99d5de6124499ea7c09ce49851f1aaa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord607
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 612KB - Virtual size: 611KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE