� �{��"�'g����NR-�xq��s����8���Z�;����O�@U_���Z0Ld|�a�&�a �#����r}�>T?&[4x�b;+��*>֎�S[b��uDXx~������M���*ɛ��m:bK`6:������a����"�oA�dݣ�$3�-PM]�J�\+n�n�Cs�`��L���&�p�&3_���+�o�zn�w�i���6��%��V��7����&\�}���DVU�/��*t��2tHL35�:� !�:Ʒ3TS�@� w�[��˜b��#�m�ܻ�9u>#k��|*�f>X L����M�q�M�]D��!-�h17�[+����eJ���cI����������i^�'f��N|o$p�U4�CW9m�����/r ���䌮������%�9�H�^�B �L��wЉ�'y!HA(z*��q(rø�sRP���Ex4�������l��Y!���g>�*ĵ['l�(�tǟ������\B�JV,���h�<O_ �g�z��^�-�f���4kד��l��g� �8��:`y�4�������=�r4WVLZ�f�)�(��G��`�أ)5���d[���^���]Ʒ�,��i��-7Kb�������j�����N�p�;&-U��T�)���~G����o1 ?�|��������4�����6.զ���L_��j�s5�<��,����p' �^��#�\^n���>��vX�ȧyf�c�U���`ܯ�h�Tu�PL��#��O� �xq���e���k�?}�*/|& �#�C�*��L��Z���ۡ&)4�E�k��.@��OcHQw���C���&9����w�ɼ��}D0 �ެ=Mٹ��ץ�=��C�>2���-U ��D�.����u>"�ի�p�� c�� �.MF�]j�ޱ�}��N,�}r?�*ꖀ^ ��Y�=bgH�ʅd �3!Ϯ�{s�!��%2�1��Ek�`�H�W<��,�W����4�x���7Y�/4�V7I�l` ��W.L�꿹����D+]L���l�C���"!��?lLK-���ʻ��j��rq�@�]9�0�"�EK�&B��2A=)��+r���3����8�(�3�!�p�f���M�"| �����j%���?����U*T���r��'] �fR�F�Z��������8�xsE�3ԋ�Xí6�u�T��}�F u�^�k8xUB*c���9� �?�����8�v�)�r><�8�l����b�7�et�dE �q�,��mWYt�Tf�8��>��M�VҦl�"V�C/����3�T�J����+GU]pOXØ&���a�Y{u΄lL�(>APo�i�-S��/귳�@������O� �27k6G�<� ���A�s=��/�{'Z&¢^ߚ����n���v�O�O��u�"���!���t��ؠ�>�o�����9�C�HfʋG,�o����h�kO8a�$��7Y?�f[oߕ���F#������E0�/���T@L���4 e<U���bB�:1*��M���� �ٕ�i����9@�ֿ=�.^�U��xw���Lm����H4�� �J��ImG������tI�Ti�}d�0�d��p���P�x����-]X���lϞ�F�A����N�z8�+����a?�<'Mһ'c�������@іN(��L����f.�Q�UFK[����ٙ�1�T~��Z��0e"ax&��"���f��"�\p�RE,ֲ+{���%l�P��Kx�I@�a_4<!����@{���;�E��L��A���^N����2V �Z&yE��J�(^N=KU���P�G�%>:�_Z��a[!�2�����&�X�X�su,��C\w�{�CS�C��n�.n^r#�:��%E���;g?�\�0����ٯS4�i��t.�)2 ��:2Oo�͏Ȉ?�OgRJ��n�"Z��6�Ҙ���֠�w+W �d�9iו����#��i��t7�4N|@�4�W��4�Xkm^{�9���Y���h�ow`C��?�W�h�l /���oT}����ac�w�J�b����'"2��ZľP�(X>s�r��+�g�4nW�?��"6������OEqQV�/fU9}�3�e�_ �p���@���fz�����b��H̗Ns����mcGf?�ijv {�t�Q*0�{9�'��z���7;Կi��n�&T����qv 9������ձ�!���/&;bz�'�'��k�#��Ri����8�|�ܠԬPw�����Ë�A����Lv� ��-7~�V��v���~s�������� ��j~AI��n��|��]�aK�?P�v��!�xr��ƀn��@r(5j�����&K������M�ط�;���]N���6(�k���=�o��7�����dLf��i���V�n:!�J='FnЋ���ӵ�#3[s6��m����.�0�(���=��i[L{�80$�b��%.ó�������M������V�#/L[B4n�����(��j8|d&N�P������j�9{�H�{~;a��Ԛ�O �G3��-/�KT���n�_L�϶a�ݲ�� ��D!Pi@��r����A$�גjƿ�,r�Ef������Q��x"�~�s���W3��xu_{�8��$Ʌ�dp�Ѣl4�@i�|^ U��������[{��lH��S8��3u�����n��Ok����{"9�hK�.H���*Y���8m|��E�_��}��<��F']��t�Y�2j�����~%�5��c�Ѭ��R5������i� x����h����rl�v'9�GA�V*r�Q�V���5y�P��dM�5���2�Z�6I��x�B'�E�B�US�cٓ�A���vCcHeL�"8ԋ �jx�_ٻrM�P������l��8#�c� �W7El�.ܢ�qJF#b��U���?�چꨪ)�_'�"�X{��BJ_���$�\X�r��'Jw�Gu ����DʗWx��-t�q)���Q�|����x�#h��)]l�(��K���?Kb?3��L�>��ʣ͝b�Wz|#\����e��=JɅ�L��⧜
Behavioral task
behavioral1
Sample
71a3200f6bb4f68b1fbe39857a98c042efa958ddbf77d271874995a24eb46f17.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
71a3200f6bb4f68b1fbe39857a98c042efa958ddbf77d271874995a24eb46f17.exe
Resource
win10v2004-20220901-en
General
-
Target
71a3200f6bb4f68b1fbe39857a98c042efa958ddbf77d271874995a24eb46f17
-
Size
548KB
-
MD5
04acde1f57fdd312eb055c1d01732eb0
-
SHA1
a1798807349e5fa8b05c233839cbb26f04d2e2ed
-
SHA256
71a3200f6bb4f68b1fbe39857a98c042efa958ddbf77d271874995a24eb46f17
-
SHA512
e62d0c14eb43413e35b1013895694d1e0eef486fad5f9d46aa4b46e6460162038ad61e300f1aa0696b75aee850f0791d62bd16b5d73ba7c5ebbccff81b870bff
-
SSDEEP
12288:yXd9mCWZN7fVy5kLeWm8p81BOW3zdVJgcaTlAgoVuF5gvih3:anm5DzweHp8KKZHaTlzKuH
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
71a3200f6bb4f68b1fbe39857a98c042efa958ddbf77d271874995a24eb46f17.exe windows x86
f228f92ab88732318fad6cf0d4e1d9b8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord307
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 532KB - Virtual size: 528KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE