�=�TV�<J�i�2���%�f����v���efӱrjEf��/��W��^W�xVn�0�MZ�۹:G�s��-a�,�:!�:F-�ϐ(r�ي\r�b�=�8���L�O��%���q% �}�3|{�^y73�t��X�p� � �� �������f�1�4�*T)V�/.A��FЭ/'��A�:&�"��|)V䇅_D ���u���.g�B���B������/��L�9)���u�r>q��4},"6L��s�)!��Y��&.���1��µ�; ���J8B����̸�(����!��T���2�J5�|ڊnK�ĸۅ+=�ctL��Fw�'_Ӯ��M�a���^���^���~��$�שP�;� fP�h�=+6�*�Ǔ�Q/{��C �2�mY!�]��+.��S�\�"��|�������X7T���:�d�Q�FK��>���©}�)8G���)�k�x���o�7�ɧm;ٽ6_�_?ٟT�}�eAV���� �6���)���r���)���'_T�Ѳ8�d��s��vzr��ʟң$g ��_e���8���K���S� c0Vl�z��}�������❇�K���Q�����a^�R(Sў�� 8�1R߭��N�����-r��M�!l?�+1���vH�] �H���b<(V]��(���m��iwv�"�1 B|��9� ����u;&:�TSc|v'~���!�VB�&��=ȿ=9Ù��L;Y�_n��:��bj�ft!i&q*FI-(��'������: <�eKa�R7*Ę˸_�0P{M�)����$��-���ѧ�|����X��߭"M5\KK�B�N"��;1�/Z9��v��o�y���B��T��$��C�!�) �Hݪv�胖����4���q�I/�e��s�����5ìSF��o���=� ?������1iD�+l�Ȍ/�̒+��,(ƃ��U�����?�L��<�n�%>�t���G��wK��JE�~���,�~��"��������G���>����X�v2���K��W�K�̆7.a&0��n���ڤ�G�gj3��wDx��W���]J�{�^� �UV>ߞخ����,��֝�_���E�PC˶��af���ń��X��@Σ��}ާO�{�̝:�Vl�%��Sj�_�g�>,����K;��#L����$c2�X������|S� �G��B������?������/_�E����/�=P�z�x�EXG8���ș��h������i_�?��w�<��#$l��d�9�o��Y�`�y-� m��%��0���j��� *f�&�$H� �~F�������I��RZ2��sw��CVڀ��g�8�:���FK�-����r��.N�8H�J&�" )E|C��b�DyfP�O����QHzg�!)��}�|L����|HX��/'牊��Ͼ�2�»u���LjԸX[��E�e�sFD�f29� X��g�;���R��0M�ֆ,I�d���L��iY�_e�٘��,F���Tn�dB�6�q+�c�qnV_���P�@��\����e(�NS��t%���I���D�.Kٰ�W7�� e��1dC�/lj��cxK�ˏ<~�V�y�ͫ��s����ɠ��p���_ �>u�,V( �'ً6��;��Kx��|r�d�K�"_)�Rv�Mu�1���G���Ց��rD���^����b7���CJ� �?eo?�j4�,#ب��$�)�`U��,$��Dw��� �\p���߫��Yj�)�]�#L�9n�x o���발ZՔ���� u|�r!�a� 87��Ƣ����]Ob�5������w0�{�6c�bWŨ��w���K��4'K��wk���8 ��+��.��Z.�]�������eb=�x�yN:~u���_�҄X6�� 5����c:��V���E�fi��z�:����r^�E����n<���<s��2����'��A�|B��k�U���# �s^.�x���dyQ�y�iQi�� J���� ��τ��{�X�c����Y���������M��O��r�\��ݲ��f�[��bt�;�%�o�^�iĤ���z����ܠ[�s%�\��uu�V�K���М�'r��T�T��A�����O�G��omJ��'l�ަh3�w� ��M!8��Ȍ�^;��s�pЯ8P7�d�Mʝ��T=��a���e��s����������rRX4_s�F�nE������|~`g�䒓���%�ތ���κ�]�� ��Cr<���M�(QE�6�c�������x�s��J�3�\�$�A�Z7�K�þ~w�a��i��PW��1���H���Y�����Y1���Ȼ�K\��,g�58�fM����}�Dj��DŽS�T����R��w�sr�USd[��(��g������O����thuui��y�yO��&�uZvꜹs$$|�D0�i$�RT9m����Ć��P�]����ړz����2�O�E��5¬��ҁ4,7Qu�=2�t|��.cM�,��P+��uY����V����gT��uN�kn�AⲟX�� �=Lzi�c�f��[�����W��u���t[z�i:(����Y����j�7�ɗڧ��� �0F�>{�����z�؟2V�rh�����n�����-[G"���"걆�Q~�F����~HP���(V�����i�L��X��^��}���ٍփP��sT=i�ۼ >O�3�6�AQݺ�t���"��!�e�F��I�e�wu�1�z&E�p���,��X��Y���( �+6`M[�]�j����f��d����k��d��_Y���;, :?х�������͓vѱ�~����ʸ�(�>Dra�vn���q�7��d����84�Į��L���,Z��Ĝ 5#��I[�|��#�)3�!%�䭊>C�VZY��P����3�C=���d�<e��V��l�:����eJ8�V�ڑN�ˠ�n�cR����ַ��P�m��4�lj��K|�B��s;�̏�.�� ��m����u�O����`m��p�*�W��4��O�:&
Behavioral task
behavioral1
Sample
99eeedd297ab8587b8f31f0197a2774d34c49cd9ecbc105482b37156bb59463f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
99eeedd297ab8587b8f31f0197a2774d34c49cd9ecbc105482b37156bb59463f.exe
Resource
win10v2004-20220901-en
General
-
Target
99eeedd297ab8587b8f31f0197a2774d34c49cd9ecbc105482b37156bb59463f
-
Size
580KB
-
MD5
702d00de2ccebde4de04b73177c57af1
-
SHA1
0beb4d238f7ca8a6c240fe503a74911fc0197ca2
-
SHA256
99eeedd297ab8587b8f31f0197a2774d34c49cd9ecbc105482b37156bb59463f
-
SHA512
fe0117964cebbfe61a9d40bca1683062f6857ce0ee89523d0f14de41551aaf0a853c0f12ea924d7144604b2c2004db31846234020e4b1977fb2d9ff40b251211
-
SSDEEP
12288:7/DeMjIQoi/W5BWuqy1/mZMCCfOY+yaOR/bMp7P54+Kih0X:lfW5q8ECWYxnMBP5Xh0
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
99eeedd297ab8587b8f31f0197a2774d34c49cd9ecbc105482b37156bb59463f.exe windows x86
71fc43cdf07d9edfea615d7df24210b8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord712
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 544KB - Virtual size: 540KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE