� �F�0�@�X�DUmE���פ��@ϻ���'$�J�����P0^Wj8�C\��u�W�����z�~�n:UV�ps��eڟ;qZ]�k����0�������bE@G�'��M¨x� ��ïb�r�F��{;n<t|9��7|�n|�c2K�_a�;�E��~y����/�QF`�s�7_�ļ�sgx�d++z�u��W����� ߃?��+kXH�q�P��G9���b�/ߧ�7�cp�x�T�l=U�:������zw'-��2Y��6��v��Z��ȷ>8Fm<�M99"L�'m�I���V�W�7�$�֒NA�����\�k��p9���N&�/h�2�^�OF]�w��ק����b�u��C� �|�P�1��>�>N�=]0�~(���68ɋ����_�p��;�m�+���r�^-�/�{W5s^��������&K��I1�'� ����|#q%V_K��� ҹ. �),e�������,G���vڸ0��u�����:��Ni�U篚 �D|��cX��$��^�V�S�sa�e�؍#���8������,~Օ�ߧN+ �Yϧ1�F5WϞ6��R6�0���<1!����:Xަ�;x(���+O�d�mQS���4�U8 BĹ����� ��Yel�S&��vg�}�A�n���s����I�?�K��Ն`I^_���dݥ�[fd}6J}���<��������J�k��M�N<lX�&��A'��mȂ1��Y���u�#i~VZ�U��8����ٸi����a.Q}\��$0�p�,�Y3�H�����=�g[W�'�&��x��S�.��m���3J�( M/��ٙbB�<f�3��;���LY�c��'� �¨�[RL�N4�/z]u5(Gʫ>���t���dQ}F��.^�qO^y��-+d>q,Tb>/y�"m�Er�����ƃ"�ef�)�\}�fEf>Pߘ]�O��!~����D�J���fl���|RK�[<!vgN�9�t^��B U��s�[hZ G�b�[_^���R��t"�xHQ�b@�&��8��R�gW�&�%�v$������$��5���t5k�9��s2�. ���W�w�Δ@������Å\H��☞}��� �1<����"p�%f�og�£o3�!��2���R��m��lg����r��z��죜�Pǀ���F���x<z��8���+��[�B+w5���HR��G�s#:N�Z��p�a��SBRJ�t]R� 6ΰRW{�t7q��J��l}��-L*m����3�.��Zl|�}B>?e�1���v��a�5 ���MS��������K����nemQ���3� Q)���2���d��%�dG; �w����z^��z�IQt��������K2�[e����ӡS�X�-�Sb��juKd��<�.�dڷgk��KRFP ��5��UFb@q�W3��K����� [�+����4��┺A�H`o5��%��Qͨ���@lg���NDi��{��4Ò�K�lf�����-���0)Ц7�H���ZX��{l\�z[���%}��V��̳(�m- �ٷ��o��<u��� Y���F�69np�����B��/@=+�MJ�ٰ�������H�],�:^���X|���3��u=ذ�)Gy��'�\rlED�J���/'F�O�w��)�{�x���:�r��M�aiC 8_��^h����naL���Og�5ɵ���<�V[0�F��%&�v��R�d��ޏ�N������_���ψ��c��ƫ�� $�J�'����z�\��CV%��2:��Z�{R�'�"r�3ԒG=�����ʐP>+��<�N؊�8+���GYP*f9콤�OW����1~M��s� O�1t2����W|�kP�ڜ��X�A\�tW��q���;*��F�I֛AN�J[���#�[y\�{��뤌���߫�Ej�_���K��M�N��5�8+�{�M���U��h�/�d�n����F��h���A�7ԝ��� ^�$[�C =�R�8��6 �$ۗZ ��~�>檓���^��U��@~��o��P��|����=�u�#\�Цϩp*�����NǴ� p�䷘�?��W���jf0s�T]�P�VJhF���?��jK��3���nf��7d[|P��}��O=���g�x�`�@�sC�*?�ˁ�3�}v �]$�����J$D������/�Q�B�����C:R����G�f!���s7��7���]���s��$�J,x�ݢ=Z�#F���ː�g+Ʋ2.O�0�&�<�8W���K���L���r$��&p���l����5Hl�g0���sU�>�w�+�c�d�b����d{��A3!��Zyl|�V��3��}#�p~ VҒ���f�{17����/���^��,�<�X��X�mD+��!��*��X���������=�H�DC�T{����p��4A�.�T4=����gw�xpJ���d����u/�?��y�G��ca���H�qp@��-�XߟR���r�W\���o�;�c[Gc�ؼj�*,Ӻ���댻��1���D��N�Zwu +K)�̽�[E*U)H�v���$�*�u��q@⯻�����X�JD�N�]O��� �)k,ɥ��rt��������(�9�ԯє�u�i!���sL��;�e'��v��m���;��+����K8E8��ΩJ*��a9�:�j��ʍ��j�Ѣ 2,���_A�,�ʎ@�,��xJ>u��T� :������#���,2��%k?�'�ܗF�����������)ۯ�ڣ<�8g��[:�*����PW�w�s����މ�����̑��>,�R#Mr=A�Q��>�y�f��o���`�������±J�&�k��|�ޣ{�qs�w�K��͐�L`4 (�)!Ƽ�K"��mp�e 56ҢP����a}u0��!��ꡐ���Q�S|���.�*e���ڇ�@�}P��KZ���C=��Q�y�@�?���TI&��1p��(�>���X@r��7������<]{���uS��B>�{�4n���yY�[�������L�FZR�Ι�Ya��>1��dd�Ӡ\꺭{����z� C�^pg�2
Behavioral task
behavioral1
Sample
c57ba209ecb3e9115cd6d308c643144a41ea3f31e15b18333f8bbd5f5f5847bf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c57ba209ecb3e9115cd6d308c643144a41ea3f31e15b18333f8bbd5f5f5847bf.exe
Resource
win10v2004-20220812-en
General
-
Target
c57ba209ecb3e9115cd6d308c643144a41ea3f31e15b18333f8bbd5f5f5847bf
-
Size
624KB
-
MD5
6fbca38f103dd06124828b7f798ea1c0
-
SHA1
71a0e9f3ae7b61f4c8553bebcde539b2f53b5a8c
-
SHA256
c57ba209ecb3e9115cd6d308c643144a41ea3f31e15b18333f8bbd5f5f5847bf
-
SHA512
428a3b16701fa8f88a55223de2bf20bfbf960f1103c716b4d94644ffeab4bf81d554c1cb3b6e9ceaa4d6f6b72f5c9c88ee3ea885f6d9ac6af48c5d8f1e1a2fbd
-
SSDEEP
12288:5Sv3NEZSKoq7A5WUYrVT6u1l4V3uWFmA4nvP8Kc+N1Ey+G++cydAX43VzfN5LNQ:5Sv9ao7VYh9S3ngA4vP8KcSyy+G++Rc+
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
c57ba209ecb3e9115cd6d308c643144a41ea3f31e15b18333f8bbd5f5f5847bf.exe windows x86
376dddc8e33c4e50ce968f2506829425
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord711
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 608KB - Virtual size: 605KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE