Z~'�ݍ���@���fZ�7ܹ3�03���52���P��|u�o���u��'F��R�"f�K��<L1�������7�%H��{����]"�}L�!��sa�w@T:`8?f2T*�M���ȴ���V��1��� 2�}⫳��� W��Y<���������ѕ��w=6!ξuPks���=5~�a���� �nz�K���e/X�d�}������p5�}_~>W&uX8�/wům.�(��7G$�J�4� u/�mt R�xf�?��y@Sm�7�U��ˠ���ֿ��a��.z�a�����uB�ξ�lj�����@SudDv��uM$߬�A��)cKX��;��Y�X��C���ЃZ���v������x�=j�|���&svѕ��H�ny�s�R�ōF�;�����Q�����BBW|I�O������qt쒫��Ϣs�����&������-�F�-�$���q� �jSKf�r��!�a�����zd}T��]|�"ǀ��M�a��$�>c$D1� J�A�s㏆��JPcX�qx��,���TW�;��d�i=��y<(�1�\�7�1?=���d��g����<i�jұl��.m�^M�Y��B�Hҽ�E�^��eNMD^�8�7���K��w�f��q,Ut��g_�U��%B�� ��ҭ�ih*��ʝ�[��[��|ޮ��(�_ ��ەL���%����ԟ օ��t���=T�UW��9:�k��f��[j�5��#�{����lw b�b�o�h��=��B��|����x��LY�y[��,���bY����r���<�G��8���)��l��P6�@$&�8�����[�i �: -���r W��RS������:t�9�x=�bU�(��4:LI���^;���d�y�&�l?�+��]>��@(����$�!nR!�֨UD�������<DX��6[���7s)D���HCyL?��<_-eJ��������{%ǂ��J����!��E��_�t�е ��4}e�$����utV�=�-;F�,.���o���71�U>)g�q{f���B:Y{��B䥖��;w �6%����I�8��U� �G��[0���Fo�[(W��\R���&.���$�$���U����1�o�E]�/�R����6 :�R⼚��cU�~U�Ʃ��>óXTģ��+�}@G73�����m ��A⸓oHJ�i�-j̀�T�����Z��� �n�8�p*}]�@,���>Å���)�;�s��u��o�=�lX;`!�]���-<���$q���i&�>�J��@�ng 7�#�D����-��R��.~8����c` � �/�ɩ>�+Q^���sDR�r��t۪PJ��M����Ӂ!n��lͼNAQ��e�����-w�2\s��'*c�0*O�fh_���>���(�ڔ+WI��0t�yS������i��b�n���)D KRH9��3&ar�2!�?ϔx:�-6��b^"������8��[~��~��Uw8�^��)�08{��64�lK��K����}h�6J�P�i���:�rYץ��d#� �*��!��a��O:VT�I�'k�y��XGJ��6;!��ʆS:����T X ������V���V\��]:>��7���)����a���7,���9���� �)4�a_���yܕ���V�����ȧhǨ aw�eO�%�r��樜D�e�B��m�Є��o���s=ڹ��1������� {1 ¥� �>�p�*���}6m��U3�7��@_�z :Ͱ�6w���$�,3�a�����B�� �X�� 6]Dvn\��ԇ�@/7�b����r��zV[3��B� ��8O*��2�~���>gݻu��MW�u�z �F�Q���@@�H'#h���#��\�=�ƛףլs�MiBY�Ӻ73��*Ĉ`UĶ-�AM��Y�=�'��]O~f�ɩ��'ހDe9��;�|Nڭ�Q��f�*�݄/dRO²u���ֺ䝯�J����,�l��[�pp偧�~乯��vAN��m+u`ʂ/�N�j����t0soZ�{3)�5��wƔ7G��ϧl�˦����\�4�V�a�49ehCA*N�x�b�S ���w_%e(�J��/_w1xd�#�D(� ��!�DN���b�:Q�s��(�bR�CR���D�~�f%s�?Z�;���)y�C�'�-�[����\��u�v&�1s{���,�r����<)�b�����̬�g���ШE3���`��;�5��J/l+�_ҝܩG�9����ؾY��8�O=�;��X�{�<*sXI��(��4�+��a���Z�:{� 1��L�Ԫݓ�˺�L�pc��j��vJ��K�Z���a|Zbc⩤�i����L7�ܧ�Qx1����%�ڜ����:2��B�Dž��O<��g������wwq���D�����{ٝ2O��{��P��MR�N�9���&7��n�k��pC���6F�1��Iy�}��iTs�8�mUX������K�tJ%4�T��*��+(@��z}&�>:t�ؿ�XzZ�Mnuv�8@���\�����#F�>��`��Q���w¬�� R�Ӷ�t�E�dP��V�\%b�|�I�#�sְ�ʶ������f*��B��Q�Ҫ �����Ϟ�ԊyQ�m�u��D��.��8�"E������� 5I��m�*�Ld����'HVp��tfys�>�[S�` ����/����k�G��VJ$H��+�.��ʴ�p���b���ĺ�"���-Zz�]=�9eМ'��O�䫚>�g�n��4�&!ׁk9o�0� eib[H$~RbLʼ3�d�>�Q<V�҇����_+� �BIش?�����$���G��%�ع��-}]�䨳�M�V��uT���u��7�+������K9^�߆]���~�X����T�FO���6}�� 1��#z0���wf�,�'=�K2f�.S�a��(CH�l��csr��ա��P��P�䧳���<�|粼��ʨe]��� L�.�y�O�,�6Vs7�!�s��:���
Behavioral task
behavioral1
Sample
b68ebfc3f28495e256d0514f13dc78ca457e504b8e4b1099340d440a75ebf74c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b68ebfc3f28495e256d0514f13dc78ca457e504b8e4b1099340d440a75ebf74c.exe
Resource
win10v2004-20220812-en
General
-
Target
b68ebfc3f28495e256d0514f13dc78ca457e504b8e4b1099340d440a75ebf74c
-
Size
732KB
-
MD5
4ce5bff4c53954417fc98dd98c1e8df6
-
SHA1
d235b36c1115539079d375b86512c2d88dd85a70
-
SHA256
b68ebfc3f28495e256d0514f13dc78ca457e504b8e4b1099340d440a75ebf74c
-
SHA512
a09f0fb4eff750f00c0e77826e92d75915cf53805e33937b7b4e30e4c6d4cac968b55eb327328dfbfaa72c5f9913b2913b79117f96fa27cb18e282e5d4adac22
-
SSDEEP
12288:yCfO8WH9FyspUfUPXhFNx+N9rcPKjaPVM95d4m+7VNBeBoxh/XagrWu3:y8rWdYtUI9rci8in4l7VNmoLFqi
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
b68ebfc3f28495e256d0514f13dc78ca457e504b8e4b1099340d440a75ebf74c.exe windows x86
6a90abaefc4c4b97280ff60a9998762d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord526
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 684KB - Virtual size: 683KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE