���O[��']���� 6ݨ6ڢ�UiK��b� &z����.�T��_e��R�\������=�� ����F����@V|ш�L��M�����{���ͪJ�}ț��6��#P�`^ �5'�X*�!c��}���U��yVǴ�;��O��q�q�!3�l.<��b3� k���cCvllϩ���1���`/��$�W�5ա��M�`3.d���M���Y0Ԧ��~n�=D�ŭ�ɉ��I���LNrXS&��C 6���Q^mi��q�t+��-��I3F� �&,A�Q����4@ƒ*xl���uOSFiev��_6��M^x��!$W?����������7���>���WS ��h*�-?� �1|�s��B� d����w�S�����rv���+3k��C䫴K��H�2���"j z�S�����3�l��q�%Oj����%9S>���;$�)="�вv!���$��\6)�`C.id����Ņ��"��L�z�B�ʇ�oQq�w���N�z�}�x�V|�2�L���3����C"�͒~����Q]rV�.� ���#8�?|ey}�_�O��;�%���M�/�y�%����.��\u�E6�:eW�A*��O�#��O����52���r��*@-$ޞ��B(.`����F����xE3�;��9H��vO��� �)��}��`�5��D�b?VC"mb�i^[���(�#�tT4 ���V���GE��,�� ���W���Y�@�>5v�N���Yͅ����uqb���]w�����_�R^�9�;��U)Ϊ���AŌ�] ���QB�|�=R0lİ����K{�{�W�Y#��m�������7>xK<���T�\�x< Fi�'�������@�l7�(��/3��b~.��]����+"|�+�u��������YM��p�=|������ ����RX]�C���cMaS^/7�cgĉ����/���� Gتgg���PO�-�ȣa ~� �c`��N��Uւ#���� ��d9>7���L��h����ƺ��A>�h�-�!S����t�2<��+v���;�S�-��H�����M~�?ώI������O�=���=��z�^������R��c�[b�L��.ӄQ�F/5�uT=���$�XsH��S��ާ\��)1"��\Us:���/f��u�un�Zé4��ޓ�`��[0�2������-� �è3�ʯ�Dw�y"N�ګ�����&Y�;��&TB�]���Z����t�6����:�����$���9 !�4t������9'bs�x`j,2S�d'�>��p�R�x1�)f]v�g��1%��!�-��$}v���^���尀T���6l�}m#d�庲��?��� Hn41��q���%?k�R���8Շ�$��-��O�]�-�.=�@h�r���,@��]��"� N��<<Gp�D���"�?x9�{_�4u�xz�������"��n�R���%�v�ӿ7W�؉�0��jDŽ���F|����I�+B����pV��A���5�/����`e���� ]�hA>F�?�?�I<� {)�2�0*{÷�s�ah�XI%<�#�ER����{�� ���� ��j2:�e�������Kco��w�Җ�^�����!>�헤K�(�z ����$A�Cam'�'���~kJ���,ͦ{��gA$O����=S$L2 G�؈g�n�V��\�����f� ��V� Dh�'a�@������HEb���dR��ʝy��K�i�3Ě6��.7�;-G�2��|UɴIG�bI� �ߚ**2�W^WP� u9=T�LQ>�� ,���ȩ����X �{$�D�wn�$�q���~>�-��!�A���*�ۨ�C�h$-v���ћ���܉��B�d@rs�q��Ga������Xh�Abg�t=j�j����*���m��e<c�G�>,�tWgj�MrC��jS�]�!��P8��̹��%������W��A��b��L ����Ή��>�������d��;c"F�������,<p��Q������ߚ���I,Ty�Ͼ�s�h`=�$����KV<�'�����1u)����^�v;q�v���Z��'���KN*�q�2���%=��f��ĩM��% ^p=������ŷe���DV�#���RJ��Ѱ�� `V�S4m��ܚE�U,B����)���2�1�Ӈ�Z�y�)�������`�,ESC���^o� |�/��tW���y��i�T*!+<��!�ݳ�O��X3>�ܘ��?�w���c�i3(��/xs:�������������U=3Em7|�W���$�8oٿ����@��8�#�;Ŷ���r7���'`ֆf����Y��d�eG$79�<vIȵ:�߆�C�˅� �q'$1O�M)�.���5�D�B?4�����n�@w�d���!J��3"~s���-@�q�4�:��KMf�X1Ӌ���!ˡ�W�h}&�����a��p��%�JV����<��A(�4~}��E����D���5ߣ�i�hJ��Z���;j]��_��m���ٝ��0�mt��bՕ���8}�d��,��J�9e4a���� �eiꑈ���k��A�KNϩ�^�ɺl`?���;>�pPʫH˭#�K̟ɘ=Pʽ�P��V���{�]_��3hh���8߭��������q�j�У[g�;:}��0U�}u��R�~LK��-ʴdCN�̭`�$)�g+�p����U�z;�5�lQ�� \5{�`�-}��ohӳ�u�R<9Yj�nk�e�N���l�J���� :��S�R�JQ($�7�7��� ;���7T8�RNA���C�PB��_^Zf̽�q]�Y�=8�|�Ā�4�>|J�Є��ro ���SQ7�L����Q�N��N��Ȥ͙��xR���m=Ht_�ϗ�~�)�Gq�c$ԉ|0oGr�E4I��rzI>�fȏ����|ƹ��}M�4?��P_����!q��RpZf<%���A�����|�`e�C ���ԈC � ��]+��`h �@쇇����6��/�S ��R � ��ѣ5�(��a�08
Behavioral task
behavioral1
Sample
5bfb15bdda1a50a4dde84a7e5c71b23cfc11994dbdac44ecdcc7ad72264d0cf2.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5bfb15bdda1a50a4dde84a7e5c71b23cfc11994dbdac44ecdcc7ad72264d0cf2.exe
Resource
win10v2004-20220901-en
General
-
Target
5bfb15bdda1a50a4dde84a7e5c71b23cfc11994dbdac44ecdcc7ad72264d0cf2
-
Size
148KB
-
MD5
2c9351e95377419d89cc2e715af166b1
-
SHA1
b277632080061bcd8442acb4d825f64800212c1e
-
SHA256
5bfb15bdda1a50a4dde84a7e5c71b23cfc11994dbdac44ecdcc7ad72264d0cf2
-
SHA512
66935d3bd7f59a8740cb50ad7224db78119ec9e22697ec967d99d2000b911371c723294337cb605df2d6b3b2d6cce2efa37b48b8369fc1a7185efa3b6faec364
-
SSDEEP
3072:KGYFNdiNn6IDe4SZvpdkOO1k9mznV/2S7MMCKf4r:KRYNne4epqOQSiVeS7/4
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
5bfb15bdda1a50a4dde84a7e5c71b23cfc11994dbdac44ecdcc7ad72264d0cf2.exe windows x86
67ac417eb2c7047f85b8f6f2696e1dfa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
MessageBoxA
comdlg32
GetFileTitleA
advapi32
OpenSCManagerA
shell32
ShellExecuteExA
mfc42
ord561
msvcrt
_except_handler3
urlmon
URLDownloadToFileA
msvcp60
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
ws2_32
closesocket
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 52KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ