D}�0r�}�c�;Ж�#��7ƒZ�x��=���~n�2�w���UI�ApA�O{B��o���n�"�NF!�8��A��{UEΦBr=wR<���ʦaY�z���$LɁ]��w�*�;GK���{�J�[�D�j���S&�Od�/{�t-�K��6-�m�&,f2���)��ϛ���e �6ד��N�������N�;2U�(b��H��V���w� �����~��?3y�w��1���B�!��Fbr�dmG�N'f��̌�_��IEϭ3@;� �'��{5JZ6��m6Qӭ;G���R�0~���������7�9ر�4�� V�K �Ń�@����ĩ3=��c�~8�e�R�Z;ٰ<�qw��w+�������U�"YB���"V�ߋ��#����k�w�����E�S�It^ 4��)�sA�maA]���N5���e�Mk2��~�y�8�����lWNJ�.5�[�M��Exz��O$���z #�ش샚�uꙸ9?�w�_L5f Y�;m"�p��ZZ��z,^���A��y��)]�����Fډ�&ũ苄�Al�?K�5��'8l*�4yo(��+pA;嫲���� ����:�r�X�'���H�K���}���|���� ���2�+$Ԫ ʩ}]n�Ɖ�@�V!���>�T��nϴ�m2�Gj��Wq�"`>���*��.! ���� -4��03����Z3Jj��9��0�R�� �����I��^�����MP��*L71�|�ش ��t�}�?��v���6��ێD�>�ۨվ#�bi�_���I�PhZ&�[\��\�,�;=�Hk� �����Ů���� �7p�H�9M�a��`��p#cU��"8�h�%�^7h~ �\6J�MͶ����7���:�4�)�3)LeP��\�������Q��x��`*����7�(=^뭎C�9�5�P���h��~�۔Y9�pF���J� Z���n�IsV���GS��G@)����{��ma.˂z�qci�|z%���S�k^r S+y��ܗ"'E��X��Xd����S�>*�$�X���|�7�.� ƒ��<�N7<�ע$]�����0�Eꁃ�^�?;��řn����m��~��C��0�k� �w�u�P��dR|k�W�OX�Qί±��Z�����-pR�1ޔ����B�� >���KXQ�k Ro����4��8{6� �m�K_P��HD�ZJ�0�m ��]�5ځ`M��@�%x��B���� �P���w�D� 8Z'�G+�uiiX���P�ZR�q_��HY=�� ap�ɚ����D���-����j�����/-�@V��f�oE�θ��X9���� i��=98��E�v"���]W V�c�������S�SW���h=���炥r���l�kh$R��J6#bB�!TZ7�e3�O�B����)�o�f�sVX&���f��,�5�/\�ܓo{���rܡ�S�s]�F�tqD��3�z��xd& &~�u��H�k;�"�p 2�\�u*o����3�{��/$�g���7,����1��U��#2����������Ŏъ�bob,iH��6xB�����a��;���Z-(�Т}wLΒ��"i����wū �#b����8p �2�z�c�,��lJTd� f9�X�J�ՙn�W"�\���r��c���~|�z�8�r,_��WPؽJ��?��T"�/Lz����ݤR�܀��;p/��=R� �_ݴx%��gγ�(}Lo�O<���&� �c��BѼ�`Ж|S<L{-�3��w* ��d� Ɵ�_��a�G�dx���n}a�i�*�|�27�:Z�e����+����k�U2A��X�?�H���@)���o�No���DH��Wn��c�m]��^EՇ ?���T?�(���SL5��ꙿoFrVw@w��7N �v|�>�z��'+ڳ.���T��%5�E���в7�P�W�:b˲v�ݞ�dQ�!l�УQ��>� ��-�}�~���5���m$�ٜ��� �u�'�l`��i',׳�r2���er�4d����N�:ǚ+Z�Vuv8!p�;��Y�Ff���_4Sg�S�_Q��� �bO�)v��\v�tr�f�_��܂��*�����P�%g�c��\xG�j���o���Ga-���f-��C�#����O���P��G�3B.���~��;�R���^��I�����17`(UK����S ����@�2��L<cV��Q: �w��5i�|��m�u6�ܰ�1�t`���W[�����X��;u�)�!� }(��iw��i.s��ͱ�0� �s�pE��&^Z�(f�`gJm��h)Z"�WiI/��ĝx�/(����h�є�ͽm��W����I��0 D�aI��q��:FV���9�-g��F�H�Q���`��nWZ�k]=�KӗUG��8�TSC�A���j-�d�]�<90V��� ��Ց��p1�K������������x uBq��C/v.�=尜)���̫���.?�^P�%c<�M�r a�p����k���l��ܕ:�LR��i��8~ܨ;��k�`�3�Ҳ���%d4�'��e�b�8~��Y��@�9>��o��#���Xxl�̂��S�����C#� �w#[�F����/Ed�e�JQ���B<�R?:t����%��c��&s �=����r�Um�� <ne������O 1�B���|��"[��;�J��kJ��+�MS���a�q���0N$T�O1����6�� ���\�6�n��9��iSt(o�#���q�1%� �c��uRg�ʅ6el�{�������]� 3�� 2Ư9_(Q�c�wʾ��@Y��%�LA��-����k��QL�>�8����CNj��&s�v��bC����L��Q�])���|M��iQ�2.��vؕ,� v����cA�Ԙ9�p��âJf`�!��>����RE��Z�8I�MV�����\��墳���K� Rb�����g��Ij�S!m�?�i��J�[CZ{�<�Ԟ�f��P@S���I7��8��s�B��g� 9�b�l�98��� ��Q�ii��
Behavioral task
behavioral1
Sample
27b98fd682e90db1878bee4f1c18417a6deb58616635da09b303f98b58347f24.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
27b98fd682e90db1878bee4f1c18417a6deb58616635da09b303f98b58347f24.exe
Resource
win10v2004-20220812-en
General
-
Target
27b98fd682e90db1878bee4f1c18417a6deb58616635da09b303f98b58347f24
-
Size
544KB
-
MD5
96e3259b6925978aef458c6a1d55a760
-
SHA1
a71ebec9e95362fdb8b316218bbdea925d3776ca
-
SHA256
27b98fd682e90db1878bee4f1c18417a6deb58616635da09b303f98b58347f24
-
SHA512
c7f01be1e604974cbb4094e4eb9c6c43ae5b1320c5d3450eaeb6af0781c83c3780414105e2e28317ec49b1c6c3d7576e18d16cfd8c4300a26af66da0fe8bf987
-
SSDEEP
12288:G/zbuT2H/8jyZmgRg9DzJCKxtNpGca+jRv/wUHPc:PT2tmgC9DcKxnaeRP
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
27b98fd682e90db1878bee4f1c18417a6deb58616635da09b303f98b58347f24.exe windows x86
c3e6d5151d815c14450184ccde8d45f8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord583
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 528KB - Virtual size: 527KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE