�� ���������l1C�g�XK�4�è���;�3� �*;���)��+G�8���c�ሬ�S��'jZ_���R�!rjzGٴ�ŴAs�c��K�n��o�Tp�ƶ/���_�?���__����X�I�5)Zi.֩�G���`J���Zc��0<��1˃A#;�X��UA<Yv� T���ĕ,�~|�}���H9a��=��>�=��RY������U�E�ؤ�O�u�gY�m*����\k�r��y�Բ}�:>� _Γ�p������@/!y\���20Tw�ޕ�/^7��������!�����}���-/J���k�S:_B�~�,ɼ�N|�{��,���V��q�X�Y��pC("��8y�✦�<�[J� �ߤRC�˧�W��|llQn=Ԫ��KL��(eP�%)�D��w����n^%�Aq��;�V���g��,;��w|[�֊?�Ӵ�F�����Ù���۞X�O���i��ݸ�ym��,�U�~�K�F�O������\�"H� ������z�|�������!��u��,��1�P�|uʜ�Wq5��3QHH���;���V{�>����v^~����R������M���b��+�h��2QYn5��v�}$��?����~���0gF��Gjr|NĴD����������'V�>�ŷk�F�!���0 ��b�Nd�:�Tv`IL��e���������8<�@?Vg��k`�gn���K�8'6���FG��Q8�~6ܳ�%z`��l�d:k��7an� � �Y�F+|l��Q�����#a���E�ڠ�0��ƃ�O{|:1q���@���5�L�^.$�`�$g��O컼���������<����F,h��f����]@udN�w���1m���\��g�A�� �;�W��>���"u�q�[�Q}��+��;c����'�j{i��PV�%:�,�>��R�?B3��#� t���@���^����:$�NLj``1����z�v�GӪX`�=��e���u�F ]�?�*w|������Qtu�2}<�����i��b�h�@��ϋi�3{3���$�>� �'��q��V6�ə8� �Z�`Tp�$$8&�^������&z&uP1�nC3㘿�wGG�w�6�J�WTE�ɡ.�3L��2��L�C?�d����̲2x�)�L�o�Fq�F&?:d1}��8s��Q�Z�)�B� ��f���2h���:�>���\A�/��:�ɬ�Z�kj��t��~�b��� E?�, c�� %{-x$Qr6st7���ܐMǺv�9 #{}g@oO���)c��R֘o���E��I�ؤ�������<�_�ۚ�.�|�Y�WɅ{�ObE�ؒ��nө�C��y�y������7u�g��+��-O"��ҩKܽ�|6�X���N`�_lkwT�f��ȇY_���y(e鮖;��7�T�h�Fԧ0pj��K�a#V�a���y9#��DA6]-{O�o1��U>)����,"(`������3>V�n��x�a2K�j�Ɂ�6����|�o,U�dA$bc��PB%��[6bU?ֹ�������/%խ����s���R_�U%y�Z��i�C�o�u�%��}�>V/�z%W��]������]�_*��g4� =+�����[x���'Ʃ��qF��U�7�&��I����.\����i "|;�j��(���T��ծ�A=���̓v�4ݔ8�rR?�?� �r"L�i�)9rG:L*���$�{��hZG9d/�=E���������V�F'�o8�8�j�ա�%eP�Yh%�66OT���o6�G���Y� �4�MzvP�4�n2�hU�����]�R����]Z(&d�2�Fv~�À/&_�N e���=u��bAZ)���~^>����zb�=W�Q�5{��:p.QY�e�<��Z�2�û�/����-o��}�{�i�iC�yo�U�Jp��~�&9�l�7#�>l�6c�zE�S ���(�b�Qw�A�i.CLl��N�;���N���q�t�\�*�/\�D 2�5��j��Y����t ֓9�X�q׃OG� ����Ɔ������X$�4M�q���҅&�@��j.�#M����K9���=�P��J�1C���f �&k�#C`/�S�F�C;$K|��1?6��*��?څ����.��@wސ�|��[��b�bw��VT[V$�nR�W�����K��$)���eS�d缵�p+-W�X .�������!�[���10k=�� g *䧢�\�$�/�~�<&��j-lG�0��L ���ŅAQ�#��3�石��A��%�n��%~�!d�69A[j�ܑ��F5b��k��M��Z`|G���)�q�$���H~���܃e��p�TYS�N�wy�mTC�7�Ï���n���0:Rz�W����ԴxUTYR M٨��}�@�>ma���^��gL��o!4r�G���w���rs��c@w�]>7��MRf>�/)���4w�� ��V���:�b{)S�8��+�R+8[:R�����;����k��+-y%�%x)Ѭ�ۇA�f �� ND�i�ai����{#Ẕ菬���Ɠ?i�R'�{�c��G�|�yr��?+��_�{b�v*�����T�d��T>2.�(C�^��8��h�����}�u<�Q84�z�6�bt:��k��-*-n�8���5�uӀ�O����}g�͖)���ݏsL���»6,���ȇ\n�l���8�E��n���x6b�{��5G��]�k��^?T�t�ZW�> ��TzD�ҰE$g�Zw�O���W����6���ib��#S)��(���c�v˄!����qere2O`ڗ`�_����Xk�g��(��?${����X�k�[��K�������q������s�Ф]�xB���|������YLz�����.��Z�I*�߆��4��^@ �b2rNM�� �O g�4���>>�~@�{���+��.R3���� Ȟ��L�Ť u�� �&mdi�716��(aY]�}Ngf=���g��� �*���P�wi(�#N�+�_���`���-�@C���
Behavioral task
behavioral1
Sample
9ba82c23520805a9ec8e10f9b71a0b3eefe83d6f0ab76a64eb6c20644cf2e655.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9ba82c23520805a9ec8e10f9b71a0b3eefe83d6f0ab76a64eb6c20644cf2e655.exe
Resource
win10v2004-20220812-en
General
-
Target
9ba82c23520805a9ec8e10f9b71a0b3eefe83d6f0ab76a64eb6c20644cf2e655
-
Size
628KB
-
MD5
4aa759c5cf3c8f40380c4d8780165aba
-
SHA1
01949c9edf40d63c8cc17567366bd137ece6e723
-
SHA256
9ba82c23520805a9ec8e10f9b71a0b3eefe83d6f0ab76a64eb6c20644cf2e655
-
SHA512
d8dd50caf7c0d86ad0d32b4002339ecec9361fb8cceafb1fe4478dcb0b1cb7f059fb18c314284a77d39d75904813dc691ac4da55bb186039430a28689dce2a0e
-
SSDEEP
12288:AOpiNEAa8gtUstXsDR2PkXMCQUsErmA3c4WX3:xQNEAeus+R2sXMCQU9rmA3c483
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9ba82c23520805a9ec8e10f9b71a0b3eefe83d6f0ab76a64eb6c20644cf2e655.exe windows x86
ae8224cfe9046ea609ee655b2ff3fb3b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord594
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 926KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 592KB - Virtual size: 589KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE