j|xy� ҫd�E�L�VGCn�<C�I���~jcjj��>qȵ5�A�Gk2c���Că�M�,t� I�04讝��6In���Qj{`�|����Z n�-@�2[�klq������J��A�^SI4�; �r�k���g!H�F@��i1��u���p�A���������"�����߹>^'�z�3�ot` 8��������������1=�[�Y%�$��e;�&����7��������Gb�|�x&���ȓpܲ�u>�vD�ΨBB��I��9{jr�D�\�$��v�T��ܢ����@��Gy��廮��_r�1����|Y ��6ڰ��N��&ڼ�c�P�.���F�� ��_'#�����=0��D��e_&K��_�yc�?�L_�0S�bv�����~�������]���_?���D$�d��!<+�5.�i�%`dKM+?n��}^J�12�g��g4 a:`PFE�� A��HCA����"Sz<�K��'�ky({�]�n�T�_���tρ#AϚ�[��*8��`e�q�g���&%QM9e��r���:Y��\�R�ז0!i����H)\�7�������2�A��0���@����wsқ�Q�����Z�Q3�r�����xp�������P"Z����ʾ0}�,��h�v��o��v�齃��`���B[�>y�kJ9M�l��=A�A�B���;���� ���-p{$��v�����I� p{Z��Iֺ��-��G��k�_x�K 9lQ:��|�K�m�D�uP>�� 2An�I�)㷇��L6�F�U�����1��2Wt<lf�@�c��kָ��W.�4�|+�@�/��C��v�po��jq����G�!c��R�)���� ?� K N�k�LJ9�>&��K�b�V�U��F���v�$�d��1@�hu*�����~b��<�r\ǺѤ �'�y8� N<2����[&h���0���`&� g���QVը~�)מa��m�ݬ�:x���ю�n�F,�p������^Ӷ�x s(_�n�)�zz�Y���o��k��N4U�vB[tk���'��Fو�YS�Rc�rR��+���u�cJ:�B�1����$$j#�f�UN�PyK���])-�CC�j� �/�~�/z=ŇQ�1�8a"=�'��)�>�7��c��1ӹ�C�p��1�q0�/dM���^lZ�_%2�{)��?젘g��'m��P��.���|�c<��<R���ܒ��y)&�3�[/O;J�%�,���}/�-> (8���m�I��ЭP�6�yf�"��dwp!Kc[�Qs��4����a��G~~Ll;��ܪD�mD]�&��/�J��5��-GI^w71ы��+_K�0�-\���ST�������%E�j�0J"���h�b=@땚�y#]��j7��{:\����@�*~��Fg� �'��-\�r'~��&=�x�0�)�^o� D�<�=0�b�7��<~��o6u~�=�D@�1�r��/:`��������`"4)��\��P�s���O�Q,���֣�Gc �Eą��4(�N��;a�ߥ���R2h�����R��c��S $��� ���/����&1�1������O���6=���_K>��3�!0 ����T)��k�Q �G���>�z�5h�p���W<5�Z�c�jꨙ�[�#���N��2�^%I��n� � )ҡ��M(ՎQ��zt�b���/�o����h'�N?Lk~�6��=�����z���a�7_��k/������ ��r�$�9���:����|<�|ЊD���>Y�#����a�\g����߭Į.n�S�P�;c���tX^E�p��!1:�+�������-�[��`8��E���\sk���}$�������B�['p�NH��2�}��i�>��q��"��I���o<���*�.'G*�8ý?��d��8����S2��I!#�<�r���g+�MY��d�y�/�M�h�x� ZdB�D���z5��)�L�\��O~-���sg�e\$�ݮ y"��7�n�)�!7,�=q��?>�ݵz� �N.�R�0�y��g�C1��KԂ�,Bv=ۣ�~��_ ϼ<?����O�8l#���@�%��Z�;X��T�Z�P�3@~��.r�+Uuӊh">�@��R��R�y�`X��A/O^M��f��;����Be9�1�4��aq�9y2s��Ь���_B��� �V~�����6t��C��@m�۸�3�3.9�_��cbR�Uj���)'R��ɾ~����L���Д ��s��|����������R�4x����Ŏ�H��Կ���L�)~�#��Y����zc s#K)��}�|����`�c��|0��������I/�|&׃�s��V�\Jtq%� 1��.>-Aת�e8���}~�6�К��H��b��V�5Ywo!(��ي�����྾��� ��`�g*�@�</U̖6�%p�o�|���Tu����s;��|�[�� `�Rt�Sʖr���1�Y���D���5�� V�KH���z�2��5��y��&�����g2}M��a.ek��������-In�j�fk��b&�����7�5�.\1Vu�p���tӀ��n�|�q�� L�"�W�>�iXM�T�s�w�߈2���.P��� �8�@��+)��c ��[n;,���������N�g<��9Lz3-�S��)�#:T���f���|Ai�$I���$�Z�Os"������4d���+A�?�b��Z��� ��V{���A&��m:E�hC�o2w�R�C8g2% ��e�������&r�!�������\��}=�]����jXH��n�[�'��N��3�],��k*h��3Lxl3P ���ȝ_>: ]��R�'j��ش�����<��X�UR6��t.�Ox1�m��O)OLZi��-��@X�#�3�9T����CX ��ʌ>u!�����_���xK�!%�r��;N2�+������E r���`��!�&?(kb���l���ؾy��V��ql�e��p�SQ΄
Behavioral task
behavioral1
Sample
090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4.exe
Resource
win10v2004-20220812-en
General
-
Target
090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4
-
Size
228KB
-
MD5
6ff71b5c7557f928b4ab7fa2a3bd7dd0
-
SHA1
6e5200f1fe1fd61b14e4c7f3f1d0026a5f60c1ba
-
SHA256
090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4
-
SHA512
9e411e7e05392d10664a6fd6793875925bb3ad527e55fee0a6f909c215cd7f159829f46005684f8ceb5d52e4eaf7041d94f5f0aefcc43ebadb5e2adb0586835f
-
SSDEEP
6144:tCERXQAAEYLfIWLMQd6o4S8HlcJmcXsIXoK:tCEq7xLM0eSqeJmaDXoK
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
090905753b180ac055cb2b45674cf1e1f9b67e3bf43b1f2ae04daaaa5d072bd4.exe windows x86
500670908c8b2eb548b380523b4b29fd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 212KB - Virtual size: 209KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ