I$?�;I�U2:��f��9_�q�>���B>�Hٹy��$�lɯ��O�����9�&�b/�M}۽W�����D���(�����F�we"����~M!j���hl(%���^����g3�5^�l(�9�z�y�7��ǔ�����~:T�����mz��c���.��{�Z��$��iZ�����r*���P���}���u��`PV/qG@��fo�)o����Y��/��?h�t�m@�s8��E�����̤�&ٗe����k�:]x����MU���3���AI�5tiU�n:w����s+!j�h����Ԓh�7rFU��ɨV& *���/�z�J��ne�vO[ J�P����S;��K6�t*)o�/R� ���à�b�lR_5������e-�dN���VX�w�HGYJy8��L�{�*���K�0��4���V���e{�w%�nF&��^(�=���b�X��� ^T�|�ln�b"�*]�b�rj����0��4�*�n�jpª�&.����Tx�Ԃ�E�fN�2�dQ�A�X��K�S�<��n��"�<�ƐFqwL S����Qsj�c!�{K�ލ��8�"U�h ���S��]Ӗe��ʲ��f�]t��b�aJ(Wq��:�%�+�K`��f�li�C�a�`����t�R��o���W����m%�W�H�!Q��:L�������e��*��<W����f�jh�q,��A�9��e>���p �3V������|�����엍�8�Q�����T�}��6D3F"X�aJJu���;I��d�`��Ӭ,;rY��Q��O��lC��l^ r��=�Tg�� q��+�ѹ-��f�k?L�o�Ө��N��F"[+� �Y�H�C2��������SGQ0^K��T�v\Z~�;��u�r��jt��D�� X�a�>`�5#�Q�l���Cg:�XIڷve�r0/<kΠI�l���À��J}%̍��^�J�owF�|��'�S�<�8.�ϲ1��QnA�I��ƙ� � �ص� +���Y����ihews7"'�)��sP4�ۍ� O>- ~ui!j��c&)���SO�G��m�0h�#ń\� ��Z��Y,+�`,�_��}���5U�,��+6|�_aÒN���:T#l�فWҷ��B�U�_)HTLfr�(�;��`�U䠢��a�6�f:�J�"��D�wFN�=�0�M��xE<S��_� -��i�O�x�sr���|��ekS7�����u�zl^� �c���%_��hCԕo$$69��3h�`F��ā+ũ���L�5�|f�r��z��O��җÜ�[?�~�,j��C�\�Y9����3��KX?:�+���V�0��� �%�.�KWb4�!��;���O����M�a��.��\W��%.i�o��n���h��bh&�� ��w��N� F���^}��!լ�>p/�^�����b��f�\ :9�{���<~�Z��# -,�K�Ks���N�Ȏ��}�"��ޗ����p�aa�Z�܍�f���B8�>�����JNu�o� �i<�̔Ҁ����� �ʚ�x ��1�줗�`?w��xȭ.F�ַ�>�/��j�8S��w���(͡%��a���a�z�E�px�euC�.�� �(���f��j��,8c�9�j�gۂ���H���>��E�;~�� �j� ����o@>���Y�C���C��`��ӳ�� ����b��{��/v�M38�d��!?ll��!�C6�/L§p�рa�p���3ײ����VTC Èӑ/<�d:�c�<���5Kz;�y�xQX�Vr.��1�_�����E7/ !�Č'���/���p�AVK���@='��{��������<D���yx�cw�/3zo�f�Z�hF� �N�����#�E���+cH���̓)SL��.�#"ݐ���= i(�%J���F���`�BK�T9�J�O��PF(MZ[o�l&��A��z�G�0��c_��; lF��<��=(�2��������JqG��ɪ����D���͢ ��-�ޞu��滅U'Z踃g����i�����7Y��������:�N��ByߕEr�kU:?j��*�8�DP�8ϣ��Б&�x�F3���됡?�H���/�w��q��� ��������C�νK��+O%��FI� *��[���$:V����z�� k�W��#����d���'�����x-^x曆�7�n�,�òP�5�M;q�F�Ǎ5뻟6���9Y��i2E�b�Ϯ<Z)N�Z�u(i��P�N�˧����ӛJY�/�Э\��/�w�ߙ������.�⯳�Icvj��d%�n M �\�r[��l��g���Y�qf�U�t 6�����݉�A:F;Q�c?��r4��PU�z�g;v�=�����4 Nq��I~��|N{bo�DUj��)''�NyS���Ϭ1�>较⤀@�)!�z3$�I:Uȸ>K�bJ�|�l~�2VL�tꭺ�N4Y>��f�[!�%/F��d4�sY���p���3O�i���e���\-���sW~��_A�AC��S 85��+ U�zF�[�| �@���7�N�>����6���3�u��Γ�*��g����[{/��,C�L���i�� "�����=%g�}C3�Z�SK�%kpM~��N{�{x�ba X�_7����VA1��,�9��%���O&��ҿY��o��n���H� ���A��&_6Ⴭ�F�u8����/B����ejű.�l�>����r��P�1m��Z�[b� �4��D�=m����"�7���Qe��߅b�/|l}�^��bl.�h�(����Bm\��"|'��c�Uw0i������3���M7@B����ps8�9s��T������pufH: [fm�5Q�+��� ��v������I��v�Ĩ�#a&灑��������nu�rJi/��E�i�Y�U��ѻ��U��S�( �'�.��"?h~н��2�uf�ό��y?b[���!Y��?��lݙ<Л���A2�Z�%.x1t@�_I
Behavioral task
behavioral1
Sample
c717f505fe0c3ca98632372ef19b46c20b6672736a03522cf9f799407ae9e685.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c717f505fe0c3ca98632372ef19b46c20b6672736a03522cf9f799407ae9e685.exe
Resource
win10v2004-20220812-en
General
-
Target
c717f505fe0c3ca98632372ef19b46c20b6672736a03522cf9f799407ae9e685
-
Size
548KB
-
MD5
1a25744a35723d7d88fa7f9abe919430
-
SHA1
5678aec933fda75e815d1693b72698bc36a88817
-
SHA256
c717f505fe0c3ca98632372ef19b46c20b6672736a03522cf9f799407ae9e685
-
SHA512
d91c6863deca329b2d7d9d03d6caf6ee88220f2b61decfb10393fe51564db9292532d5e300ddd9dbebf36066506c4013a80939f6f0ec092f528e51bdc3f08536
-
SSDEEP
12288:Z9yLnlTX7vuJgymureN5XnxRwi4JASboDmoeBGLV:Z9alTLvuwlN5Xxm+SQreM
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
c717f505fe0c3ca98632372ef19b46c20b6672736a03522cf9f799407ae9e685.exe windows x86
3922ef0edfeffafb85a042db5d6e4b84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ProcCallEngine
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 532KB - Virtual size: 530KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE