����]�.7��#��aw��%G�IPݓ矜)� ��% ��e�n�t�� 3Y�!��.;[�Nސ���㊡:(���ے.� Q.%,'�`�/��ⶁ�=.L�o0ಐ���id�vlo+Is������ԗ Яr�(!���[�i�E>9��y�$ʪ�<'8�̞H"���f���^9��Y�ȷ��N��%��X=�?�ϴ���>pZm�Gx�E��[\^�d��z.wZz���G 훪� ���̄�Ѐ�q.@�10}_�R�rjx�ZkR[Z$���];p��a��K����(��LkPi���$�y2���W hM�g�,O�+9_�Z5g�YF�j�11�Y9Bx�K��<[�S"�L��^�uk��ss�2�1+d��Sx�Uth�jG��u ��hCw[M� :�V+sz�7�����O9��/����l�,��$v$�\"��j5�������3Nr�&m͞1�V�&Ϳ2K�+d�Р�>�dd����l�<,/�d�EE�-��:>����_+x��|��q�u�Ƅ|�[����;��cp>:��Tȳ���1y������=��\l�������/w�G�5ܶ�.rE�M���j�"���)\���qh[�S�� M ��P�ğ.���w#fG��Ұģ^ʢ�*�#t����T��b�w���i`qB�y^�nV8��p c��O�sz�Re 9�fu� �+�)i�������S��b*l��9�,~��R�ǵ�'#��H���Z��� �NWu�wV����+@�!�^=�Gp��RT����~�����|4 �Rй?��=�_oMR'Ru��u4(�T�H���7Z��#y9X#��ȑ�M���$@l�Һact8�^��ί0bv07<�?{�|ݷ諔ʨ�|�_�[rvѽ�hH����I:����&}����i�P��-�6���ܦ�k!�sĩ��N, <2�ސF��E-��0����v�5ތ���ݠ���.YBc�c��1"�dk<`'j;䗼���-I5��`�1sK9r�e5�.?�$I��6^�Z2Z��ս��8x��9Em`���ࡺ��\JC�����wmA�:A㢴r���h4f�����GG�]�%}�/,32J�7S��-<�1^�+��r��f���I��Ѓ����TW��i3Z���̶��*�Q�aν���hl�J�M:��&��d;��ːVu������G�OF���coZ� �҈�E ~R��)?w$�1�D�hЋ����c�D#����&R��%S�N�M�+�¦����-�o����eT6@Ü�y!��p7f,���z4�,�0Saw :�Cv Y��d�� ]"���Ə4\��d7����S�b1��(�u����7|�l����6K���1�oǝ�5%�S�$,�SF��_��R�h�C�qP����4��I��*W ļ۬�<F���r��.i�4��&D��EҮ�2�-�`---��z���V�f������4NN�q�B��(������k�[v�7ÿC��7��ܦ�;U.>�뷞���jli���%��%��?�<ER�K�7�'�8^y��P�n�MJ���ֳ����^��ojR"Ѽ��A��C��]��0�c0Bf3:�b��D`+Rfb'g�9a�� ��a_�u��$Q�2��sMieH�7��M�U8��^b��?��Y��� N^�|�ʀ�5���ӛU�[R�D��+�H(qh�hΤ#oъ�s���ɞ!�Dq�����5L���&#��o� ?�w��a�zIfK�*��N��ћ��6�P�|��^���,z~h fk�QGᣑ�1Mܞ��%l�3%�����6�Q�0��D����g�gZ�C�@#/�e|�4��_{Q6�:MJ��<f}� ��2:6�֫���A9��A�֪�aE!�1H���Fj ��f��79�ho�L���Z���n��9���ma��o:�chzZa�!s�,?w�ś��_��$ݶ�s�?\a� `�t �9��K��_qT*/��a(��7�}�hFN������#��E)��ן�Ձ����C��@�3�ġW�[|mfԱ��� ���� �l���W|����jiF�7����k�9�p�I �DSdC���˖�e���t� ͤb���3`���ZJYJ��ǎ�X0�rq����8��#�-���a�d�.Q������]5���bj�} ��v&�����Z%���x�F��n��ǰQ"c�k�`G�*J'�Q�~���| %L�}D��0�Bp R5�l�[*���(bf,V�M}�k�_m������P]0�Uue�'�Gy�z�xUְo��Ԋ`�F���P���A�7���h�ᄹ2`��ؚ*����A\>�4rkr��ŶV�s�q��?����%�5 >{�Q� �@���j]�?�9cK�O \�g�c,�~0��Q<�VFF��#�L����C��J{�F,v4s�En�bt�a:t^Iu�E��6j�;-E�6�I�F��{%��+��"G,q�B(�ɋy�����J�8U5��V���l�zL�������ؼ�������{��H�害�.z4�t�Y��-�]h�zI�mGg�?���S�$b����̻u��/����\"�ߤ�]����8�,]%}F;.�sz�|��|�|_߹L�sZ��.��@�H� �,?'�?h�����pY�D_ՙ��\7 PE��Ԍh�'�c!C����N��������RO�6��G�����QH��r�;(G}��WS�[. �S�s�����8�뷄�2t`���!���FŔTp�e�!`�P��cNAS/�8�Q�\��v��f29�0��i��h�X������/��i��ӭ�}�B6J|H����[F�Xi~}]�p�<.y�����J���Y����2���lʞ���"ۉ���*oKK�f���,[����8�P�� ���_%�P�҅jm���!Y$J�) �6�J�Mq�����<� �Q�* }����_��C��)�ҚY� T'$�L��Ui�3����ٳ�'X�"�}�n���.�Z��ojf�Kޫ_�W��?B O�2ܚߪ��R���t(2E���~ ���1���s)�
Behavioral task
behavioral1
Sample
3d8a40c0c8c2fb8f65fadf80f8e3a0658c53471f75d8610c960b1392d071c8db.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3d8a40c0c8c2fb8f65fadf80f8e3a0658c53471f75d8610c960b1392d071c8db.exe
Resource
win10v2004-20220901-en
General
-
Target
3d8a40c0c8c2fb8f65fadf80f8e3a0658c53471f75d8610c960b1392d071c8db
-
Size
556KB
-
MD5
147425329f9fedf36e4fafcf97c63730
-
SHA1
d235baabace115a7257d8f2adba34797a23c46cc
-
SHA256
3d8a40c0c8c2fb8f65fadf80f8e3a0658c53471f75d8610c960b1392d071c8db
-
SHA512
cfd1b7fec7fe172b1f56970b5a4c30fcff2d49970b6879f708431662877477cef08882a7f535a0ad8f5f9035d9a3ef838f6843c7aa097b7ff51ecd417599bab1
-
SSDEEP
12288:w+LrQCo8m2x9TOgsUraCHkR0UFq+kF99QMZEAxuks53onEvGIfX8iRD:nQF89MhUu+MqdbQMZEAWOS8uD
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
3d8a40c0c8c2fb8f65fadf80f8e3a0658c53471f75d8610c960b1392d071c8db.exe windows x86
999f0ae4ca3dbead6359b6974f056340
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord546
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 540KB - Virtual size: 536KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE