^)��lr�]k���O�ͻ�Xޠ�t Y�D�u ��9 b����*\Z�(�5��;]֘�;" ��{-뉛l�����tu�?��#�槬���cz@�+P&�Q`�H���#8�Y�55�Wȁ�]�JҨW����2�l���4G�~$�M���)�5ŗF�;Q�wc܅M���8z��_�v�]�ZSs!�_�q��8� �ɴ�#83�r��>��т�����/bJ��^�����Ӏ���`��h�a$�8�f�=5l��D�9�ؼ��Y38�8q����Co^��g�Z��dw(������wXJ�㷃��h r��w�YE�h��Ō k���蓺8+*�e��eb���dt3u-��ko��9�w������N F�IݞNw}�)n���t�ъ�cpE2�^���� ��m�/?W�!���1��j&��W%�����?�Mrd�gpr6\������&��������i`�<� ����,�iI8q��7�.ϾF>n�ʈ#!�_����'CJ��į��!�7${�i����1nԂn���zH��d㫗y(Oa �$ގ��Q��� �E����,/��"g��!A���H�6�De$���_<��h&�@n�_9�� YF3��I%����<F>ɮ1�V������#q���I ���K~��Ae�G5���Iǻ���a�{k�/�B۽�VQ4-*�w[Pƌ8p?��(�>�m)j��Ѻ�<�������J&�9�ߒU��<���������O�i �읜oW���Q���#h?�u�����_ѫ-�̸뤪��8wXN$��p����\�ճ��/��;���o��~��m[�|-Z#>B������E���\s�>^�_k֚���5�Ϛ}<E7��oT�1e�1� �Z7Mys�$F�_L{�Q��`�,�['�kg>�T�2��^�m���e����R�����b���@y�=.�9a`�M��UM��4���!c�5]�u�m�C�`$&��6Ռw9���Z �5�6C�m0���k@)�=d��=ܦ�)��?���@�a�C�@3d^v���̱�<%#j%�^XL�C�Mp�_NE �L�E�=�y��.�ɉ�6g�+b�[��0wۋ*^�'�i����v0pѯ��jt�ص��ۢ�#�xm����,:�t����v�3p�zo�� ?l��>��*~��- ���c �Ab����pl"��e����z���g}���>m `�������#�(7�2 � |�鎲�t5�>��@8�y㼇��qY��\�V�U�:d�c�ٜn�>�捓N��:y@d���Ɩ�t�������8K�S�V�w�S7�u��Js=���s�_��g�~���(�Z�d�����8Ȁ�_��X�*w�BF�5����TF��o��P��Y��[ԍ�wv��Q�V����=���T�sGhwT6 ֕�A��\\�+��+o"sȕR<���:�2h홍+����P]>Cl#�,�����S �+Gz,L����.��W�jiя�yFۈ�#E����j�.�G7jb�u�+��_ fm�H2^���y�z�����"�z�q����i�����oE���`�0}8�g1u� p��s���.$�¹"9�K�I)Im����f�:^��y�����{��n���)�\��r9���K\����-R ���I"��僦���O��)�i��Q��0G7��R��=���Ư,HDs�§+��g���H]�`�IA���mϪ��J�|5�D�t�4��6�vʱ�n`Z���$�!��l�?&yu�|h���j4D�-ՇC�O �{TK�-�TH�o�=�q� D����)q;�mu��$\�Z�Ǵ`�PZy c�s��E���O���6��j�P�N� ��e��R' ���W�H�w4c�d����3�Y�����?�4��HY&i�&K�c��c�r�|��r�$j>�k�2*ho�9�m��X�ë(���wҧYM���/�vJ؋�kW���ː�"9���Q��x��.P�b���Ԭ�Y�ϬP�I��O�Qb���:L#� 8L�����YO��i#1�ח^D���r`���6?��5���.��T�W����3O���7·^��B~^b����<-k<�u�s��7��\�.�G+2�lh!�A��k�B�A��ͤϊ����s7� �]� ];��|�U�@�t�~B�g�"�xԇ�*�NnR����/+�;��J�E0zm^M�~��ڊ?���)�4���d0AsFb�St1����A�h���U8k��ڤ)T>��?��eKOm�k�U\/.��O1k���g�~eB!�S#7Z(�ҌtH�l����"e�������c���b�k�WۢI'�t]aI�%L��1G�-�1�͕nD;��B��!�B0�r���. H���Fy� ����ИZ�&xZ���H/�����>����1.s�ԁ��ا��E�:P��ɏ��2[h�����-�ONi�ddi��������*�_3�]�J�`ΫX�W�XeI����]�Xk��T�wR Ȗ�5&�@�!(��T#d*G�|���dZ����f������"�U*�VX�Mf�����v*8����0n�H�k��hD�̿�:�}R��S �I,�w�Z1l��w��ބ�ZʮM8E|վ�A?�l�-��A�q���-������5��>؇�U 3�#�._ZD���ʏ�%�ʭ�sH�%\��A�ջ�E>�t���ZX�L�ӛ��u�K_��O�8x+��sN�B��3�^�k�R�<�M����7'J�5�� ���$����i&�O�_� c���Ƒ�ĺN��ja#�e�����}GYrA/!�F1�}k�H5=��ȕ���RS�!|1��u��r+q�w4�����V�;�H%��@� �k���wݞe�a�M,x��\�����_����M��\������S����D�VD��_�ٱZ�c �?��%�K����x_5��v�0�7��t�J�ٜ�Jķ����Y�`A���_��ٽM�ak���1���%,H*W!�6���}���/���\���oM�l�M��
Behavioral task
behavioral1
Sample
5c60b80021b0bf8c59ca01aebf68ec0ba528fba507015a78d1f3308174bf66a5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5c60b80021b0bf8c59ca01aebf68ec0ba528fba507015a78d1f3308174bf66a5.exe
Resource
win10v2004-20220812-en
General
-
Target
5c60b80021b0bf8c59ca01aebf68ec0ba528fba507015a78d1f3308174bf66a5
-
Size
136KB
-
MD5
215ac0f7ca7642f30805176f8dad15b0
-
SHA1
fb28f172a39b3904c3d97fd5b07b74b55cfff454
-
SHA256
5c60b80021b0bf8c59ca01aebf68ec0ba528fba507015a78d1f3308174bf66a5
-
SHA512
5a90019fcff4a99703b600bfcc87f1f9d9bae159257868c35dfc719c20fb940994d9b2d2f771e6659c995cdf0f2b63b96125bafd6df2401fb180c8dfd6ac8c1f
-
SSDEEP
3072:pX2GpnuHWdR7PdEiUjMJyGA1R7/v1wi5Gep6kHMpMGzXJupOc:dRpnpdRBrUj4yGAT7ai5Gg6WMp/ZGOc
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
5c60b80021b0bf8c59ca01aebf68ec0ba528fba507015a78d1f3308174bf66a5.exe windows x86
2ce5f3a955301ce76bd028c89db1756a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
comdlg32
GetFileTitleA
advapi32
StartServiceA
mfc42
ord815
msvcrt
strchr
urlmon
URLDownloadToFileA
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
ws2_32
closesocket
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 124KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ