Q��D�%�B�y��o_��d��P��~P/6�#��A/�QL��c�^�y���w<���Mƕ��:������v�e��=��������w"����h��֣�K_�qu�+H�Ȧ�������r�c ����6� �� ��z�������<�z���*`�;<5f�U��B��N[���>��߸r7d2��Fh:~M�R��Ge�r��l�>o&�X����>{�E� J��\����6~��DA(uPCv����jk�2���|�l���(�>J2���`s�ʨwT7�����6ʺ��Qfc��Ar��<��|�1�q���>;��(��*qy���ܩ ��3�ڟ4���8��e��ׁ,j�|�W�&+f� ʹa���"4��B���t��~a�>f3�N)N�'�ُ��D��6P�c������O�s�`�64��~���'T&�$ً�N?�Y�Y^��O4��bT��u�������l0�� mW��Z{.��`�.�&��Ӿ���ٰ����a����:[1��ݟG�e��N�3�K���M�wR"�=%��s�x?�.�������5��u���̳��1�d���<Q/�~�x�9��T��2��ASRT�Nx;�7��u�Ի�� �`�Uh=`$/�T�m��%�?"�p]��fZt�(乱WP�T9sBB,gaS'lh�[�}�U�~�>�c~���B����ad���J"���Ò��z�kb?�Ii�2 ������<"o��8z�Ml�\1 �e��x��%��3,� �1�����K��S�a`8�����;'�5���Z͵�L��(��U$���]_:���|>����7�I��P���x6�c�n�#z�9�R���t���1j���^B�t�[���(������<�T�3%d���J��k���݉aҞR�i~�v{�L����F��υuJ$�tg�9���V/��"�"���;/�����m������u���d����3j�M&K\ܒ��$:�b�c s�pl�e�)Q6�e��t�����6�uu1Ah��b��+�����4�]F?��8K����q������1��t��G�.�o8����5~���Gdm�f>d�J��x�]��A����4����>3cb��R"=��n�#b;�� H��8l_:�"�~���roz�pӞ�]�J����F�:�I ���KΛ��br�7�;)v����ˋ�w�8���J��]����ְY�����)��\Ǵ�+�'�V�_ߢ�X*�Yt�9��t�2 �ͷ��6��������Z�� �.:u���\( ��PF��i�)���0���hi|�EK"Ɵp}���1���5� P�j�y�i��(�hE�[�3r>� w���{��%�q��~����XT����(�wR��;�����u�^L��K;�;����IM�A<�<r�M2�d�V��O$��k9���r�����[��]��|Y+�^#jFxU�9zF�ym�T�LAZ>4P�õ���T9�r G�dR�6�k̛�%��ċ([��3KI������M����j�?q���2�H�cԛ��h[_��`�p�Nj�I�6W��Wp�槸�)��TuN(IP�,d=���GC��x�!�E��s�D��2(�������5/}����`V+u{y!ـ{�����f%�5�z@�,�E��ô�8�PAv�[�vr:��v���eg|�ժ�9�Z��u��n�M&f���="Bc�|̂)���V$@A%�-�lxb�A�Vt�B�2"��2��r(��j���/�q�]b{P���=W%F2;p��C���n_@���S�g,V;�PC�`��]j]�ǵAͧ���zl�3Z�O�_6��ݗ�K����/Y@d�T�oc�j�:��������-ZWƖ�+1FZ�^2���@�CȧT�����C:���r�3Y� k� Z�� ;�sJ�@䤺��Iyq𫂾>�"O�ф�KP9����o��d� ��s͕_�v�:���㬥�i= M&f����F�a��F��z�r���K1�s����Az��B�� +yD�����0����q��.Og+kÙn���� J��Y1�Q��Z�����F!���t��\S�R=�����B����z���sf}uG�^�Oe"AyP�j%��L�!��@I�9��izc��uF�[{��^�t�gU�[t���n'H��ֈ���o�~~H����c0F���s ���;�8�)Dl)!�*���WށOA ���)2�s팥�ӫ:XUO`?:�ih�b ����� ����n�B��dꜶAa�{Vv:Ye���15������ba'�B͎``{%�֏x�'ee!����az�!�������U��z�l��5��3Z+��>��n��e�f��t�����/�G�u�����X�u�,uMV�db|���<� ��cR�e@��G���/6W�_D�]��Q��T���k��=�G%4��]Y����w�Ľ�$��C�� ���(Uȟ&�wr��Rm�TC0����)n)i�.�V;���ʦ}�OG�$�c�'s=��hA�]O���,@�!�$��w�F������`�ί��D�:�J>����t����l>��(��4 )5��JRd� ��o\�d������O��X��r�������ky$�~ngH��8%|��0��� 7�z�@��M�Q[�����(��t�ő����(U[ێ���*|Y}<�x��ս�5�꯴eT]��9m}=ű�=�7�ɨ�?��z�j���d/u��ORZ֓Ӂ��ʝg����C�<�4yk�9\�V^��.�^C�6fN�8mm����L�K�k�$�+��t�`��FΆTDVԆj=g�2����Bw�W�j�.�M��c��C�Š��`Z�5��ݠ93@�lv�1��w�q]-�5ș��{c�H��Ҥ�YR9�2���q+̰h/o���֥D��<��B,�}���F� �W�����ӿl�v�>�=�=�aB,�ً@P��c^���z� ��N_؍�����;���6=�+���[�}K���w��>�CP@�<u�Rd���Q��?w�v�rp4����������O�
Behavioral task
behavioral1
Sample
d83f02da9678e271d0c7391a5313f3a8fb1ebffcf25b7e6f88482ab105ef438c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d83f02da9678e271d0c7391a5313f3a8fb1ebffcf25b7e6f88482ab105ef438c.exe
Resource
win10v2004-20220812-en
General
-
Target
d83f02da9678e271d0c7391a5313f3a8fb1ebffcf25b7e6f88482ab105ef438c
-
Size
696KB
-
MD5
79d1b13834532f73598920589e73606e
-
SHA1
24729a5201e2c776f8c28c7bec242ad3a9b30ab5
-
SHA256
d83f02da9678e271d0c7391a5313f3a8fb1ebffcf25b7e6f88482ab105ef438c
-
SHA512
29ef7d52fc5528d55071d75860cd175caad37a453312007c01a0b857cd95de098c3bd5cbbc8107e7fb71dd82c10b7bfc21240055430453a3cfef10dbbdc9b7fd
-
SSDEEP
12288:bC6R8vS6MvhD2eODOYZKRv9ctdETGahrDrtijy9D7gw9i:G6RqjMvhD2FD5KRvICTNhXrtzf
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
d83f02da9678e271d0c7391a5313f3a8fb1ebffcf25b7e6f88482ab105ef438c.exe windows x86
74ae3f73e8cb677bf238fa3b3a4c41e0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord593
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 622KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 680KB - Virtual size: 678KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE