K2�9ddJ�Ѩ��c-�zN�fRm��R 0�S��M`���y:�IC$厦!�w�D������Z:�l/h]!'��Ԕ}���������bŊ��{I���G���!:�o��lDb��ZvCt�Џm���U1�1S(�u�#1X h^��t�:�j�n���a#�3͉�juj���1`��<,",跳<xo1��RIGN�xgײ�1�H��9���"ݴ#G���p�N�b�{)0\�<������(p��!4��S��'�I˝qb���+����h= ����f��x��,�.�\Ht��lz����ԡǙ*�m�Sx��\=�w�(ሼ�'A :��]�:F�����u�%z�~BP_�#,���U�|��2e��ܭU�5��+�ӿ�ߍ��H>w�5�&��/=NЧ����*D��@&��p����k��ED/!��>�! ���l6�7�pn�ɠH�a7��R'�Ⱥ��c%��H���I���s�˳�<�җ�$�S��D�{�@na�I��P�I/�ep�Ε�~������驿�Mz�]�Pg��C~�U"�nBZ���#���˜-h ��PU6#(�0a�=�w ���@�$ ���ɜM������g�y��b@� 8���_�Bݓ�UN&{���$h)�����x0�/���a�f��Rj��ߍ��@C'-;�P��*�z�q)Uꩢ�Oݵ�E�jc�Nvoèv��v�5�{#$_��-�d���d�_�k�� /XS:��5[��Jwg�c�0 �m3 �`l=U�%�����2}��!!��xYo�_ �k9%�uL����h��q���0����9j�[�ݖWNkf��j8RP_�������Dlu�˄�]�'����7۱+�2�����ý��1Aʏm��4�9S�(_�?/Z���p���\����Ҧ���Nc�:�־��HM���QV>˕����X�[+�b?�)ǃ�H��_�u?�F�l���P��=�퍪7�/�b�xq���%�Nd$�gt����hg�@�Û�"!rzx ˤq���`_��V��B9m�٠5C0�6�?7��]�܌W�٭Җ$y lj(��F��`�ۉR�9��'�nͻd�����N��ɄI��~�3���O��iA8/���dh�s��B����$Z+�������`mo�H:��*�'0f��y�᠈���i���6��֫����*`��mGj��%�*��yvi�-���'����1ݥ���l �_���̏u��/��4��#�}x�;b_ ��kY�#���Ԉy���I�P�w�@�L�6�<OW���;[�r�Ŗ���\�2�i As��)C��z`s�k�� ���V��e��~�`n�����W�m�|� ���|��=i%���TV�r�պ���:bh�bx<qy��V��������Y��%�f�!Ξ��4e,Fp�b�=C��"կ'?���5Q�6��^�ڮ�ԉ`.Z�G�c��h,f��ySp46B=�dG�q4y+�'!{����+a���ss���%Gb-@2Naф�Hɧ������>jY�V?��Z�KD��U�+��r�G�Q\��ˢ�%v���@�6��h/۴�K���.�Y0�݄����; "�[lfx�����O�C':�w�̍V�EY{����7����-��<���-}l㏢Z��`�� G\�a�N���{MPBY��P#P�Lk*�������8�H��QIȜ��� h��I��ۙ�l�;I-�p��$��������4W���O�̟TٺX،�EJT�mU%�xf7J���� �Cά��$�605�w���Oĩ�g*2?d�M,�d����O�s���_|�U}� ��yݚz���{9�p��^����Β������2>�'3�2�ǎ�k⻥�j���ݩ�E9v�u ���=ً�-ӺNA�[֪�},��[��?"��[����,^���cl�ԕ��0��x���d���At�Q7M)�5+�0q|���/ǧ��-x�1�۪�揽������� �m���'}��jk"�A�Dc3th}YyV�*N݆�,�2�̓�C����&�����{%���U�)x����`e���Wk��k�]_��~�U�Z��1l:fB��3Q�{C�����de�S�}���u*�}T�a-�1���x Ш@���0>��Ied��5ur�)�j]� ����N����F��%�km`0x�\S\-�Ukӏ�NMMs�d:�''T�k�D�o�&p�3��CMYh���<��N����2��껨���Ĺݟ�`�'�֗�~����^�s�s����z(��*���^�'� �4��o�f�f�0�j�ז�~�`&qO#�yC�"��r.����@?�s��_��#�w��CM[a�"�í�����8�b���^��zK}C�JIuR1R2�-�%�����G '�qW�2hc!`+>�3����K (���D�DL�S%mp�N��`4���Sw2ty�A��OG���"#�'���='qf���\�@h����+T�U���Ԃ\8t�Ĩ'A7�f��H���j�����\���w�8��S� l���e+ט^�`���Y�;1�c��T6��� "�w�p���4q��������{�2f�O���XN�B����C�6�} ����Ol��PA�XLm�iD�IC����O?ͯ����f������ox�j�q�l"�M�i`��6��#�X��y�(��%2�v3�4܊Q��8��g���te�������*������c���gé3z��|9�3���BVC�v��/ҀQ�/���::r�1�p�& �C��8gwz �;�`�F(�۱P �w�ָ{�?��!˟Rp���J6�Zl0�~O)6KY�}����q"�i{۞!c����i�!KB��Q;} >`�����8�Χ���t�v_�+���,�|�Ӊf��u�q!=�;4�,NFXх��՝�h1��OF�b��J�j�NO�:��r�m.I�;'�Hhf�[�:k�P�@�Pe�$l�� �}�fh�%��~�g�\�6f���iluq%����ib���6��ֱ�,�D �%e��~* �wf�tA��������.gqx��gh�w��d�� ���
Behavioral task
behavioral1
Sample
178441b5ae025b8aebe96b8cbe633227edac923286a9da8a778c4871923bbc93.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
178441b5ae025b8aebe96b8cbe633227edac923286a9da8a778c4871923bbc93.exe
Resource
win10v2004-20220901-en
General
-
Target
178441b5ae025b8aebe96b8cbe633227edac923286a9da8a778c4871923bbc93
-
Size
620KB
-
MD5
91fb5b72ecde8074b738b3f62dd5cba0
-
SHA1
85e8c5af7d14767ff6a564acb5105838df7363cc
-
SHA256
178441b5ae025b8aebe96b8cbe633227edac923286a9da8a778c4871923bbc93
-
SHA512
a4704a817a95d2254a6262f5af370e73ed0224c27fa1ce8b87cf453c3bab693a2322047c7402dc6c411bc979e9d140557aacfb43eb892b96c27dddb0bc1b95cb
-
SSDEEP
12288:YMd1j4+bXFIlnp/259MHfUMDwczsOqsj8ZTpAQziSb:YajrF+npu59ofycz2c8HA/
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
178441b5ae025b8aebe96b8cbe633227edac923286a9da8a778c4871923bbc93.exe windows x86
af97b72704c716e5b9494e7fc0614f9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord100
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 604KB - Virtual size: 603KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE