8�A@ɛ��w�d/BY��Xā��1�PKm m�Z��tx��{�B���| ٭ê�ѯP_c�f������m��1�Yfc�>����݉`'�]�pͯ��0[���ǹ�_�R�����4�f!�Zm0�$�Y�B�x��*_��]�ij-]���h�Dc��+A�uu�A��*�u'�T �R-� �%���m��r��D!��%�Q�&s�J>E�� �u(:�,�~rF��)p�# �i �J�Ut��?ON�������ON�pZd�X�@�t���{�V��믳CQ7�*Ѐ��˄�$\ yk�!;lErU��Si�߬+��_��TRN.�GnL���&�]^%1���3�hzώn�u��v�}l?�c�dz{)g�Z�����-<'7��#�ʸt`�� ������|�:R�����6�y�/y�T3^�E@/����{�F[�>�$�&T���"xF� �P1Z��-��>��(Q��~�!��LPٵq�z�%�v-9Yϛ���A�f�[+8��1�(p9U�v[$� ��$����Jv_��[7�ڤ q���c~���sޅS�"��@�"G8/Q�S�>�fo��:%څ�zx��t�#K ꜝ|�n��Y�%��O�>�ն�h�C?�?7�9B���+�=O,<Ykc�1����^�@��1~$��""��I�S�)0������N��.� ��p�LG±�L�j�r������0}�n�gSN&B%�)A�N�<��Im�Ovl�B�[%�C�@��H�锤B9�,#;�����~X���4�"�.�o���)�SK��VPM���6�ן�5����F�qd�E���gå��������w��30,�)>OR�~�k�>r#��e,���w�h�hV��k{�L�M�S�?���q�5������_Rՙެ�J�-Q0��'�yh��y�A�$A$��� H�ZtHE��� 2n����8G�6:-Pe4��?Rl��٠�[C����8�Y���V� !wT ЖI��g������ɝS�}~�<��ċU!!U KIQ�m�P�t��J�Êa�:�J��;��s�.g�K:��j'����]v���s��!n� ?��^�z��e!.�l>�Qltw�}�轄DA^�_']�ѹ�4u?O��A����FX��\G�"p�8�~���Xy ?��}s�i�� C�Uw`0I�{C$H��W<�9�%������'-Rʪ9��xp x�]?���I��-����������Oua\�̇g���ĵIaQ8hb�g��h@��#�9�+BX�ol�Gb[ ��$]F_�� H{X����[�(f�D�ڴ3����\�Q��-��+ �u�「���pk�� ��\Pʠ'A*�f<2:0��:�⾂�����"w!�c&�R���UG#��x�t���ذ��Y��ۜ��g5����ݼ���m��� I����-0��|Q���c�>km�+,� �^K&�+�ڲ9��Wv�����숂���.*���h�R��˞���j��v�XR,j�=�����q�ǔ�%��;�����&�5�x���ws\��"0����˃��?�Z��u�V�a�RԾr5�M�����P:�87J��M/����c�ꦨ���0P0����ݝ���z�3@,#�>��CD�z��l!������u�"�[�kNګ���{��Fپt�hʻ����J3�xEA��6���ؽr߷|Sk���PB�%(��4�ϟ��Z�֕�R�翪r����L�*c*]���hY�/U������S��Z�� e-�r��������bq���I��ࡇ�i�9f�ﵸ:(�����r������`�|�;/����Ғ�:�QY�D��o��������%b�,D$<F&ӱ�ՂP�=>4!�A:2Y}�U�+��h0���n�0)�a��ӛ�0��;�ppD�Y#��$�Y9N7�"F-C��k���7`ͺJ��b,K�]T?�?�\�)�b�� o�k�1;�m ����&���%�Xj��\�x"�?�EJvF��f}b�V�@���0�ޚ+��@�O���p�����1��l �d��vv������:�±>��P�A'�n�fa�#?�DŽ�;��r�[�K���ȵ?��j��ђ�b��?0ש�rzN�wł߃M�3}@��e�eC��VU�,q���^�5�ѹ�[�G0�WU�䱶����к�6��� S�4�"����@����K�Mwú,�����������Kΰ�O ���B�(�k/jJ�`�]�+��� c����u߁�;p�d��~���d^rA��.�)E�zU����b2=�z���o��g^l$=��B���pMDXV��}����L��]ۋtd]���j@�Tr9O@Mna��������Ō��k &�v�I)w�����90qz��al�$�m|�ŋ:0���J����2�1�Cxe���h<�F �Y�(d��0ݎcD�N]nyo���XX��d ��@��#0p�PJ����\�M/ag"V� �p�ˠɢ�=�c����`���j�^[G����n$�u�ux�V���_U��ftMƽ�P�\���0��ܡx����tP*J�0��OHC�U�U�r$����T@<�*����8�j�� �%ҀKg���q1�����agtX#�0̣��K$q�W�PM�����ng�o,~��<��s�wq<�5���f�� �X��#8�� ��j h��Ý��b����(Gu�|��)���~��osc�q�c'��ςj��z����Is� ��8����圛� �*8��&���t ��i�#���-0z�eYq�.L#�����י�!DQ���Q� �b���wM��K$*���wŸ�¸�$5A���_"���㎠��5G��� `b8�M����!��b��T��}��AZ��z�6���31��Ph.�FL��@�CAA�%��&?�&�;���u�V�p=��+\�"lS*M!��k5Y�D�5��y����}9�8Dc�Tr�z���<�>FA��1�L����,�3�ߗc��Z��U�6�h�냄�AA߃:rY��
Behavioral task
behavioral1
Sample
8cb1be2a5fde7640b870069c91087456806c5b923369ec827c13c5bdd52f7e66.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8cb1be2a5fde7640b870069c91087456806c5b923369ec827c13c5bdd52f7e66.exe
Resource
win10v2004-20220812-en
General
-
Target
8cb1be2a5fde7640b870069c91087456806c5b923369ec827c13c5bdd52f7e66
-
Size
722KB
-
MD5
4128b9f7845fee5a04379e9672cfa8f0
-
SHA1
39934299b162853add9ed661d603cb72f981e1c1
-
SHA256
8cb1be2a5fde7640b870069c91087456806c5b923369ec827c13c5bdd52f7e66
-
SHA512
f236e241ed77cd8f0204144b288e55204453c1234e7f8ac426371088271ebb483030c94262dba126da443e8f2fbb31916c7e26016e64a0acc160c190d788b1bc
-
SSDEEP
12288:GuYvQ9qA76L/GHXdbXuNOmPbF91s8aJBAneWLUA7eupkIzOALjdx6QHN6UzMasE/:/YvQAkO/GHXsLb7k8ne+UA7e6gA/r6Qv
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
8cb1be2a5fde7640b870069c91087456806c5b923369ec827c13c5bdd52f7e66.exe windows x86
60edadc0d741167bdab3755ce91cda5d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc90u
ord2617
msvcr90
_cexit
kernel32
EnumResourceTypesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsIconic
comctl32
InitCommonControlsEx
ws2_32
inet_addr
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 620KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 661KB - Virtual size: 660KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ