���TO��[�KK�WN�|��~�2s���XX͓�$a��a�� �ccM�kE�6;,�t����<�-�/U�/��o�0��r�W�u& ��D�`�QB�=����;)Y���Ё�E�+Y����n�M�U���Z����(Υ��~�5lad�bP��9��}t���>]�.rR�_�}9�q!B�� �K�Q/��N�X�3f���K�W�d�S��Cz{��� 6��Į��<~L� 8��2�H����ծe�:i��[���J"q����pA9����g ���}�H�S gj��=]Ԋ�0">#`05�����3t|�+�*�{�b�\=gC�]`�A���n�n%�`��b3�e���w�8���X���7Km��f]=����W��������i�ŸN֚�g��������՛ZZ���}��2�J*g�!`F�gw%�Z�a�lPcVܸ��۫i"�a#'np�����"�OO�Э�{�� #��[rCn��������0��4�=˄X�{g)�X��(�ah^�o��{y*T��^�����h������<?�-�����,�?��c��v�n_l̡,�Z~!W!�`�F��0�KO��6�|���E1�5IJ�����jh��R�O\������$���4��cxܺ�ޒ�r����9�7 U���U����C6X�zKZ���Cj�U1p:�ԧԜx���x��;�tĸHm�A�����\�����XLG��w�±�P�/��e���!�ó��7�S&�}I�a��AG���Ze����%Xv�4�X�Q]��x��]�3��pmD0� �-E����3���R�?������P����С_��AS��Ֆ�!=������yB��XH��(wEy�:�k�r��_��IFL���0pJ58�3�VL��ّ�ȹ��]��# ��_]ՃU�,-zT^U5Jʅ����O�P!n*���R�@���z�V�P<�nV�������1�@�����T�W��}�)-� ]6DiX�`e�L���|�A�X��h���Ӑ�S�k9�VQ�B�����_T�������3�X ����|}t�͚�r K~5�h+�I5!w�/��vX,��6H���g_E��W��k ���\��6g�g��-s13��V��`��Ȱ0����ͼ�Q�\3�w�Qb�d�M��7���W8��?����Jz>��E�x��Ai(2�� M5����,A���I���gb1���)@�cZ��3T䯬�c"�ށ������@f�BG������L����2}�"�Fb���b��ٰB���)1�Z(Mup�M�3�v�\���@����Ǎ�/ ?wy�C'0�j/|���#�� ��-����〖�r��n1����7�&��FPc_�Yz���7 X���B%]�Ep�� �?������HHЬ�=��b�#�YP�7ȳ�~��?#���$�� e�4P��:K�];.�b���u0���Wd���ˈE5e������=O��g�������c�E���5�B�Q=��iR�b�ăȴ5�q��ǣ\?�"F�wyY*ٳ) 1�2k~���d��u�? ��)m�����4u<ne`��Ņ,�DhY#�����������E��;��A��k���Ե>�/��8�~Njư: �|��-�3Vǔ�h/�6�5����8�UaV^/��[����뎙Q,U�ՐT�j�v6*������)6/����4'ď,nT�G��<�'���wׄaƜd�=ŕqX89��I)e�TE���]��4��諴-a�u\�>~Y�����Ȕ�Ɨ�T8�C��(s�EZK��P�9v���o�R��k�/H�t9��*��֎{�V_g�����L�3OQ�u9�a]������� ���&�e��0o3Pb<J��iF��P�VNҋ����<;y�w��6d����s�j�p]ŕ�5���`:�B������yx�J$�� }��E��DYom1�-�p���N��K�L����_S7�M��+O.A�z'��� ��|m��4踱���d��:M�S�����c�Fg��(&�� ,e�)#�|��rI�♍݆:�ux��]È �#�SE������bQa��*��.�V���9#O�v(=��ҧ ����?�[{bGߺ����~HL��D��%�ڷOwM�}�3�����'!bK+Q�)??3�0Aؑ}�&Ij���x ~{E�`ۯV�ps�w��XJqYĆ����Wj���[p����f��W;��q3��W�`�" "�g���#�٬�,����9�]��� ����4FR����=rdW.7����"��*!&�u�"`LT��n��8Z"pje8���%g�>�Ph$�y�YR���:�з�ѯ�c�bS�ɋ}S��� ��;(G���_�j��-��m�iFP��h���_ޯ�@��H�&8��4��VA��d��Wv��!�3C�ը*��d�Я=>���2�K'���^�)��E�����d��E�&}�=��a�o?���8�QT��!�x�L? ��üAD�$O�TUq��;�2�lb���B�['s#������ۆV��3�+-��b6]�>�J]�K� �eŅ�5����>�*R倓�Ҏ�ff�l&�V�����t��r����$3���FM±u�H���(���VL��-%uw�2���f��������*�%�Ýa��q��cbrjr^zu��wdB�D��0��a~��w��t��ȥ���b�&=8��dg� ���6�mN|b�rkX�Q��U��[^����� ���@�h�t��ɂ�)�%^p��|���m:�ȩ~�)�>9�m3υ2h�U�J�i2IDՉ��NG�ྠ����5.��?�����L�(�퉷����NQ� X<S�-K#y(�ӎ_El݀N���9�3�Z��#X>����{,�:i&Usdu�ņx���V$8@�d��c^���J)��~��k�hk��@e�v�X�2>}l9bU|I�˪R���S?byR�\�pG�9�P�=�#�_�++�ٷP��k`9@�ޛ�:Ԡ<�D�rM�7�����~rM�ݵH
Behavioral task
behavioral1
Sample
e003c701dbae309c4e45ee7e3bea9e0fba33789ab21f3bcf068807bb4fc13e22.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e003c701dbae309c4e45ee7e3bea9e0fba33789ab21f3bcf068807bb4fc13e22.exe
Resource
win10v2004-20220812-en
General
-
Target
e003c701dbae309c4e45ee7e3bea9e0fba33789ab21f3bcf068807bb4fc13e22
-
Size
620KB
-
MD5
21d34753136ecf32e97b987fa72cf650
-
SHA1
2658b4f9c300d700789a5d1591b155e30d335519
-
SHA256
e003c701dbae309c4e45ee7e3bea9e0fba33789ab21f3bcf068807bb4fc13e22
-
SHA512
4de744ae1385629b817930411aa813d83b8d01bd445711379e8026a7d9a07c0f2fa15c3c6e7305212e1542173fa00e437c7214e1dd4191902230db2898a5cc8a
-
SSDEEP
12288:egMS7r4KOgKSwiJBUzTlIotnsHx4uXZqENw9YEoqvHphtK0iqh:egp7righGlFnuU9Oqxb
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
e003c701dbae309c4e45ee7e3bea9e0fba33789ab21f3bcf068807bb4fc13e22.exe windows x86
7cf863b6fd4e897e39bdb60a370a3983
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord588
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 362KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 604KB - Virtual size: 603KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE