M�����^���Yb�V�����P$��3�s��/�xJ���A��{�k�:mn��|�4o��*�r��3o��s|=����2� �.�s^9+w"�� �t��� �3�����[�!��o V}��[���T�/��#Ƕ��9�m.������$d�F��I�w�[���NbC��z�Ϭh��z��w�|�^���r0~P�d�,��'ޯ����+�;VKH;I��'~j���Օ�=wނgQ�x����l�+g���r�w�/�k������b�5�+I��Y(`?ikN��/6?�o��[Q[ �6*+5�`qs�rn��Re'|��i��q���$���Q7,�pR��4�Bb-�qW�R6tʦ H�(�0��X���@p��2F�<J�P^��H� 4K}�z���!����\A����S�����Fk9�KX�o��Y0[ܖ,�����ڙ��2&؋I����lOh"��8��r�z~$�o�kgrGĺ}/����]�PW��mSn�ʱx��bԕ�����Pz9�j�5��J��U�6RV��?�gt)�h숵ϥ|������'WW�N��tCr9���dO;����6������ġ3p���M�-օ߇ryC:�e�h�MoK�� JZ��#�C$�Ny��cGB��a�ّ�t2�L���x���E�ikp��`�����H� ���nf;������M�� ^�� ��?#[4wB�Gv8�kҕL�d3�֖�e�r�����줡�R�hCM�/�N#@d�z��r13I����_8�[�,j*;l^e��Va �5~�1�١I��lF2o�y��sIV���/��Q�> �ѢX�8��Q�*vt)���0Ӝ � 5��ݽ"���W����o_��pE�^�4�Z\���,g�In���-����Џ�@����H�ˊ�s���a�7&Ka4oѹ�� �r%��]�,ƙ����1�Z����.����� >��4�Ѳ��q9R�=,�o=�8�����&�h�QV����(<5���|�~���S>f�zc����l��I�S�U�6���<M��>��zms��@���2����z#��of��̔��_�������)�ѻ�LDӲ�9u��J��)nY�r.�"h]w��$ۤz܇W��uv�h92B����s$�7Y�U��r�n��غ���q����ݛ0��%��v���(%/*� ��m���Ғf@ŦQ�jpܢe���F4��4� s�����������'Gi�\J�賻j�I&�;NԠ��_草0�����f[�v���m��� �w Ĭ�������9;�#�0�٣Y�/�� d�S�"��$;��sO��̱%��?�tl�@w�X�)�ʮ�,��Bil��[o *YW�A��u����-0A|h@(��֬�c r7�s�M^揔�?��6�QUtG�n��UK�<`��M>��/%���������������~'5qs!c����R8�������?���zi��I51ay���l5�ݩ�i���lj�/WN @^0�����������;�9��'g��5�hv��*h��b��h���gq�A��='��̀�F��~������ ���������/m��֥Wt�)@�G|�"���x��3�dw6h�P��*�Ň��[���)o�`�;���+���2�^���;�MӁ��'$������}}�F�77��D»�I�6*��?�ח4�MfQv�F�n0�!jckt�<�J����o%��r��#���h��Ú���jhk @�u�T�Q(�2J���<EM�e�`��n��;���)ó<�P�_��Ź]�M�5t����0����`��ǖ��)��j��z$�>:� T������l��HN@ٙչ��a(�j;L!L�C��[�[oGD�T�M4�4�ȇ��?Im���q~_���@�0=m���� 5ԍ���B��lOS�S������a7�ej����-3)�%+sL_�7f�_��h��z�w��h�P �~��G|>\��ڲ��m���O�-��^fM`�y�3Ƀ%$�'㽳������f�V������*:���dd�:_KeB�ۋ�ib�8Ӧ��$��(sF^��GKT�����DJ��ӣ{_�i����ZIsEm�j����>Ha�=�M%�k��B& ~����?dkw!��,�@�4�pP�ٶ'H�H�c'ćͩ���� ���p����U��͚���&�K i�8.���_1��m�x%��:6�M9���9"9R�/2J�����7����uW-&5XT���ۧ�LՍ�����.y��6���A��8��t�����&l�&����V4�"�c���%ң|�������^|���Y���F�����)��'%~�;�kܻ�6/�^8Ն^N_/}�$�k�&o�ظJ��3��/��m�,N����K����@�M��"��6�����ş8�Z���/��Y�����u���1b�8��4)��<e��懩� ,m��l���U�n��J����G�3^H�� Ǟ��Ṥ�*��y���lmҠ��yA�1��1���o0l��h��� �F��>H;�����p�2�_��ȿ��� �QpR����J�FC��loO��TlM����K}�+�Bn�M8>�u}>�� ��l��e�u��Z\-g��>$���I{2�����F(���ă�@?9'��O�^��!<���\b�BgB��HD�Z�}:M��}oj2�K��_y��e���&%|4Lo��2����<R��� �6&(-tHP -)������C=+�ԏ��>���j��L�����8E'�>�J�;��ڋ}�ܕ�0H��?#�d���{�aX^��1���i�C�;E�6��4��S:X*3&k�v�Z��q��]ܖ4"EE�mi>���)���K��i%� ��>�-�~�L��Ʊ�i���0`|���}(~%�u�B�@ے$��ř��t~$=2C���[�E�_�����u�(�?2 ��f��R������V�,�Y��N]K�����@yvՌX�t.HS����6wd��Ɨ��w8SOx3�@�/��DX�$�G*P��Dt�`��)h" )�Me��/
Behavioral task
behavioral1
Sample
9b5bd069eec2923ce689db75d67753eeb58486f624318b247609164121220aa8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9b5bd069eec2923ce689db75d67753eeb58486f624318b247609164121220aa8.exe
Resource
win10v2004-20220812-en
General
-
Target
9b5bd069eec2923ce689db75d67753eeb58486f624318b247609164121220aa8
-
Size
548KB
-
MD5
46daf3e5deb2daa1247f7308659e1196
-
SHA1
70dfaf2eea4dde51160d43df44d17ff7e1a56be1
-
SHA256
9b5bd069eec2923ce689db75d67753eeb58486f624318b247609164121220aa8
-
SHA512
39c2e71079ebf20d5505d4bb0aba9bf1a0d1fdf79bfe34b59d4a771860a2fadc14443dd9b85edc2df7509551701462f298b48d6d27985ebd0d02f08d647de440
-
SSDEEP
12288:WbIa/+kowO/XoVFmO6rvNh57F4XIwYEmE6WDRnztzwm:WUw+kowO/WAzNhEXIbEAstzw
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9b5bd069eec2923ce689db75d67753eeb58486f624318b247609164121220aa8.exe windows x86
ae8224cfe9046ea609ee655b2ff3fb3b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord594
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 532KB - Virtual size: 531KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE