�h3�Ǐ������`? b�V�{�̪zU��������'���i��������0���k�8�iE�"1wґS��[A��>I#H�,k��\L�θ�����<�&B�t�]֊nS�F�ٜ�>K��w��[��&Ԇ��6�9`}�v#��۳!��&kL�z�]f������f�L�r�B��z���Ζ�1�>8���;�T��'����Xb5�eɠNeg����<�|�H�q�A��� Bҿ;��f�G\m� Z�/��1UON*l�:+}��LTX���oP��EQڦYΰ^-e_�-��e�{�C�K:p�.�A� �� Z]Z�2[���$c�����;)�+ �!�����D(&��Nqޮv�^Cw��e��I�#�(����T�I����Z�gC�3�?����悶7P,��`D8<��tch7g���N��KȬ��k5�!�/$� )j�<��ޡ-����PE�E&��[rZO��=�)�j���0�h�~s�/�>^���bȳ���s�A��GMe�!^��+n�'s8�Qt��ZϒWzC�ݍ���:�2ڙ�����>��̓���':�w5e��E��,P ��B�����'s�s��ΰ���_��(��w���x�ȜT����ı���e�]34O�=�:�v#��ꊢ�DE<�a�)jF�D��J+m;�{2{aؔ���/n{v@�<��!<5Ժ�3ّW��'�]K�Pa�^��Uę�3,�?(kxK�I��Y��x�? H0"xi�d��WA��a}��v�+6&DR�]�l��ͻ�O����/;,9���zDzRg�,�*�������o�i��a ��kW�F]�A�MT]> �.�v�zty�H�6V��n�b�j�{,+ć$*8�����SY �B�wr�ؑCJ,43b�o�/��n]Uq��>^n���c[��\��=X%5e�㼤�U�P��e|>S8���)c����:�wj]5�d��x(Ql'-]n<9x���f;QP��hi`E�+�N\��a<`_A����1�5~�~p ��yhv�t�_W��c5*�W��d�Ą��0hC�W�Md��*z�;U��Z9e�������>�KA���6��6���J}r�T�V0�H&dLB3>{�Mެ�@�Q�x|#z�#��֎�ӎ��B�|� �����p:�^0�75����0��kUb�%W�A�D�ُ�S�2|X��Z�D\;��^͑kr��/"����FWf���|� �k'º��>]v�H�LI4��,� oa <[�Vb90˭��ʼ"r��(y�;}<���?s�]�5bN��A���)���($�ф�����Q���`���0]Q�@%$m�s$�����yg���+�U`x!��84u7s3�8*lVӇ�3a����p�}N��۳�삶�N�X�8����s��}V������g��z����9D��{��m|�d��k�/T�@��P�b>�Q���}����nTVD�]뎊P��"z���9< ������X�+������)G�<�Ȍ!�{��D�MBq�:;�s���+�Vi���!�Ʀ���2�P>�٣A3�;h�aY�9ٹ� �<��*�E�V6��tq�=�H�Xˬ���i��-o��u����瞶��� ����y��5��<�e�La�5���H�eD΄���TY����9T!$�53��a��:�=�2���f]sv'I����c� D~�]���@!����cݤW�gD�NM"d�5�5��X�a�p�q ��Z���вG�wBM�/)�,@���2�W+FE;:�<�v���s>�ӹP=ƽ^A���i�cȤ '��UVZ�r�L��P�v#E��G-|.P�fq��Ed���t8]3�j+���h�������s1�U����Ps4�x`��@C�ɼ��Ɏ_zu�[?����_ŁG����#��qOv�`���c��=Z�v@��p]�$��"g���*}�`!c �]����BY���x� ��� b����5�Yv �PE�Z�����TKH�d�4�S��U=Q��O Z�nK�{�~j�A����F�+w�o2D� ����ȐqӁ=W��a �"dWlx����#5���~d����+[[���y�*�>����+@d,s �+����9����6%$��<���+���y���𐂮���T��g�Y�頄sr���C�,� �;ms"��&���D\�ԼܭY���lX���эt�&oF�F�y'��[�I�zM>f��=Y*�s��.� ��]0V�(��$7~|B�u��=�����/AF���б��[�ڇi��������3)�����7�� �y }�� \H��t�F"��ʴs����-�ƥ�Z�k/_�W�rz3���evYH�=.�T�|(A+�0���Lj�w�ɉS���6���pd��ן��)/O*�Z�*�p�����䓱A�m���.�c� ޱ=������\�ұ�S��qx��Ȥ�> ��د��j��/�xd�j�C�����M8���^�?*���OL�!|j�{�=$NQ�x㖶�$8 �S�����r.mN�c�~���ϝ{�/6�)�Ŝ�5H}n��uF:�ʍl!h�����Wy<Y;8��i��C!ؾ�5��5*0�@��4���*B_������. U��`�r|$��ȟ~|���������[��M0}%s��=K+���Kξ5T���Z0�3<ߙ��B�d������q諑�<X�L�$L'�t^-�$u�q,?���ӊ�OxX��u��ÎrhdX3�~���"JA���(�~�+�7.����J-��q�ƹ�<r�%shj�!��÷�ZU�@�ؘd��ŷ�O57�~��r���n���X�X�3�5��]l1fZW��_c��� P�X��� �Z�Ѻ��*:g\l4�9O:�׀]$��E#[c�Ռ��F�\4;}`Xs�5��r����EQ�&���������D�`��~������ܱŜ�+]y �5lÄ؈��y=�N&���If�(��@�9 t?`t6��s���B�$א���X�;�e{�?�{��N��q�W!q3b>���OC� �ka�,� bJ���?��]����s�pj�9x��=��&�u5��k߂����TD��O
Behavioral task
behavioral1
Sample
74e544be8b39402882b114df0654b5b4b5913f3d5d7cac06d696dd71ab34bc38.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
74e544be8b39402882b114df0654b5b4b5913f3d5d7cac06d696dd71ab34bc38.exe
Resource
win10v2004-20220812-en
General
-
Target
74e544be8b39402882b114df0654b5b4b5913f3d5d7cac06d696dd71ab34bc38
-
Size
564KB
-
MD5
65d7c6f46f60f6ef88f9707296b1f6e0
-
SHA1
12553a7f78e3402cbb917122103597758695fe5d
-
SHA256
74e544be8b39402882b114df0654b5b4b5913f3d5d7cac06d696dd71ab34bc38
-
SHA512
76980de11414db3f1307ba40f17300d47672afa6b8b8d496e1eb0658186f2a0bd09e5fca96f01f34197e42d9b1d86ecca90076a4580b057581bdcbda056767eb
-
SSDEEP
12288:KbGgOFrXEoX89iJ8417zMEWsyJEk3fzFg7HB7E3:KKgOFTE48avXJoJB3fzKB7E
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
74e544be8b39402882b114df0654b5b4b5913f3d5d7cac06d696dd71ab34bc38.exe windows x86
9b8c180ed6246f196ac7dbe485b7bcd2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord582
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 548KB - Virtual size: 544KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE