��((�W������Ah���0��ښ�o��d*5���N��q�=���ǘM��(�7�e'f��ZdӶ�ؑ}��E�=�%ʘR���fտ��u�2��U�K��&�7����+*J͵�<�yQkL�ؔ���c�£ ��E9v&�WAOT<�S���h�9���(TާM����G\�b���r��(��emCֽ�0�Bw�>x����{`�=D��ڍD�?��E�PkZ�ܠ�~������^^,�������x<Ӓd[�B$Bcf����=� ��6[t������������X$�T89ݚQ6���6��A��@��ㄬ���<�UBw�� ?ݜ)2��[�����iNG���j�����鵷JG�Q\�� �*<�T�b������C ���9���^�NAG�d�Y�Vp�ԟZi���H/lE�pN�Kx[̤"v�V!�3�aw�B֨�Э[%���b��gX V��~���L���QV�V~6�~�!�ƴ�4���N��;DB �`Dr���V����6e&�\��,/y�?'�V|���Zb|���O(w51��K���wX��A����wm�>��8ÅO�e\���}0��D��%����!X�߀,���{�Prgo�={)��uQ�0�B�}�����*��h�����,���[[ר��_���W^�����Փf�1�;b��j쯕a;���_�.y�\0 N�o��8-�Ň�[��(�l�n�T|! ����Ϥ��D1�ap�ޘ�����e\���hf�K�wЅ�� 5o�����E8���L��5ʹ�/=^��S�����E�\ћ�.��t��v{���zA;.����;�(�?R��G���C`�V�f&3��@;�mg� ��(��0�Oxa���>C���w�c�#3�ܜ@7�q����M�eE�!w Q�U�+�zD�+1ۃ=���r�9H �%��:*�Ǎ T"��i,�]�4��e�o\�Y��e���q�����g���7��RΙN��@�A)�m��om�AB�ե����O7O�,����O�WD�e�H*����[@Y��d��:���aᤉ�x3��7��y�E&MEv.*�GHؿM��"2]�YtX&���<.B�s ���D�p���8��;������(Q�O��Q���7׃ ������g�_����Fe0��½��$��T��l�L �)�Sl)���V����J��4O���O���%���f�a(�[�0a)N��)�z6莌~)���!�yÈ�A�����~�������h��l���c���!�*b@hm������� h&�I�����ܠ��.��7;юS�ab�hM�tq�����Xx ���1��c�Ub�a3�X{�`�*�ڽ�\"�.�[�4Tc��#�RFY����w��"Hl=Z��|�8�ڋ#�S���(>Xe`m�W���YΜ۵�;��ʶ���ܐab�+���J�l�)+�;AJ���t��.��ï��v�e��8I_�u���QkF3�700"$�b���E�#�p�Tq��Z��??;�r����8Z(�Uu:����ޑ�7��xծ�h�.T;|S�5�4��j�W���$�@�j�N?�;^�`%��1<D�a� ��.��;��?�,T�394�a����L�C�<�/�[*�R�����< 2�L4I��/�D��;�w��+��&�~����=`U.���mr1.�K(6��/�[�h���{@%�:�KIr��j~��1�Lx ���d��*k>Gk��0�1�W��{/nK�|E��|�ܳ��E4����вh�S�`�Z"�m���W����F��,=��l�:��$��#[ B���{k�H�2�y~Ӹ�9b�hU�z[K�녖��C�7���SI��e^Rg��gR��K��W&�ɹ3��2�����]�nfI%R�]�}�0�6�xuJ2$��B�-k�A��o��x�y]���gKH��c��ƛt�`ēN��/�B���_���&aۘ�v��ބM���%cx|tLw�X�ԥuU���6���1sh��p���0E�Jwr� �������&6��9��Ef�Z=w�.AsE{��g/�L�@6���O辁��ub��W���A�|Cl��4����$?9]ė��FI�-/�%S �)H��D�^\:�2�"�5$�I�� �;���yc�G52%��R���ج:��M�{>\�@��T�ګ����Z���T���n��t&S�ms��6���y�VO~2o`�_Eb�(�� A��O$�G����`�SjՋ�;����eo����r�,�,���z��_!G��� >s��'��e���%N��۷����������>e�N�g�@r���V]�_��<��W��M�uK-J�/w���k��CAiC�g&�D M |M�2,��o���Ə-�k�.��ʎ��5�����-,�L=���u��u �s��R.��⛤�R,���{������➊��ik�჻Q����]Uvk��4�dI7�<�{c��Z`O�( ��l�x����ʪ~�V��Z���� A �� ��I*��6b����;ti_Zj,6ren��II�b�=�Va2t �4抜�z��őr0j8|_zW^oD���Y��sl�-e��D� ɦіZ��b�^�)��i��*6��F�E�pYV��(�0Eo�2q8�pAz�sc�a�kCyɹ�m��5���/\ey 7E�M��L�gcTd���E���x����-U���Oo��\t��P��Z�D�' ���X}��NB����i� <p�� ����&�4x��O����ն����%pO�G�~^���KC�ԥ�G��0i�΅��-��j��~\�h ufD'���|���ʜ� ,��r�`I&�m�����}Bض�}v�%�$�:|�=��H�`�H0��vz4e�j�眡���+U�Z�/�o��!�ܲҭ(|�a02I/�� sM��@��\�R���ש{ ]���צ~� ��/2 �<�+�\c��R4�����o�8jL>�����&/���A�����D4�����㑿l� �OK�%�������*6��U��;��Xw����0;�6�"�7=�/I�'��
Behavioral task
behavioral1
Sample
677cde8359a0791e1beaa3e39785bbf5e9471f7d4b77e73fd162dab54102d1a3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
677cde8359a0791e1beaa3e39785bbf5e9471f7d4b77e73fd162dab54102d1a3.exe
Resource
win10v2004-20220812-en
General
-
Target
677cde8359a0791e1beaa3e39785bbf5e9471f7d4b77e73fd162dab54102d1a3
-
Size
556KB
-
MD5
911abe692e968335bbfb4816e8dcfed0
-
SHA1
e743cc4a51ad1cceb350ca00f69f1392b14f7646
-
SHA256
677cde8359a0791e1beaa3e39785bbf5e9471f7d4b77e73fd162dab54102d1a3
-
SHA512
19f2d8c1afa29e3d7cd37dd57307a56b9adb93f58e001dbdcafdb10e2ee2ed5afe2b4ed50fd61e81766f72aa7ced8620a3d7760e7611fb546fc2668fabace628
-
SSDEEP
12288:a85p83kDh2ughVH5ZGVSnbEnLWKfeS6a0UkZN:Hp83klyrYVQbEnLWKfeha
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
677cde8359a0791e1beaa3e39785bbf5e9471f7d4b77e73fd162dab54102d1a3.exe windows x86
f228f92ab88732318fad6cf0d4e1d9b8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord307
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 540KB - Virtual size: 539KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE