�]�����(#%4��:��v@��~]�V�3~0-~���HI8܇���g����l�J�)ҏ�tyK���i�x�ٌ��� �&��5A��5��q�(T�+��}���k�]�Z&��͛��-%xl{���y�U�>�=���O��2R*��f z����V@a�I�q���O;����'®�+��C8S���m�J��?�� �Q��E�*���z�V�:��U�����x��G�Yff�b���L1��$�]��/%NIx�*m�0:>�H� i�$}��*Pd E���zn��+:b/�vNV&gXݛR�ޮZ�Y�;u��m�DB$�&vP�f����H$3r?́�j�4&{9`��Y����fag�L\�=?5�g�FH�ݠ{8���ҩ0��փ+����?����{d���a�@:��,��լ�,=H�%�c���}ː��j�a�i]��='ʵJ�&�h�q��ǽ��m��c����aU_�ok D�)�X�9���yށ� ��A�<�3� F�;��<�&^����z�v/��]�%��I�'Z��ʒ��$�� ���[6J��]ڃ!��*V�(\w�*�M�ˈ ('̈��Z��h����663K�X�����=��� �:h�>��p������?b$����Θ<*�ൢ;�&i���.�Щ�Y����]�w������+�z�x�� ���7+/�h!ؘ:��<�֖�>��N��u/f�Nr�mi^|�G��d��AޙҚ/S�dg����Ϊ�V��3YJ���F�ʇ�Q#G��K����4��8�?�K��P�W�|�^�~����9��v�K�U�%�r��"�*�n N'��&/�@��mح�������R D�>�8\��+����{�����:E��ֳz��f2�ս||����Ο��g*����\�q��4��[ ��]3tA�8��r��a�,��6��4��PV�N�Q�xis�ʙ���}7�w�Bm���2����1w�4Y�[�� p� �4"��}}�pi�1f��Q���2���)�B`����%��hՅK���I߄l��k?=�n▛g~(4�]�k�0xK���O�?���9��N���)��h;�㠨��h���D��zLvO��+�l[xn=*�g���3����p6WlX��{|�.���n�"́e�5���(�`��C��,��|��v c�m�؋}V̶�WK9�����f#Qt�6 vY��..��k�Y� qۊQ�N�7��4��!ř���d�O�#'�K?��I�R7�]*!Ӆ-�q*A<��y\<Ȗ�qGڅ{�W�R%Ȼ�+mMke�ؑ۷Rv��w��A�'��ɲ^@,�Jأ�Ͼ�I���_&�^��⾪^ʯ�}����Ԧ<P�W�}��1ľ�>Їi�?f�!��J9t'm_GDzNn�лՂC�Г8�hH|��w/\L���h����!�������n �P�*���a��˧��4N*3[���Ѿ����^.�H�Iv�$%6G�&p�/�G����T�����.ew��2�@��˨]B���x��8ɘ�p���]��7���b��[E�J�;]S�qS^k��I"d���������?��0]�.��Abew��߶�j��>-���M��ךﭜ�v�j�����X~�߶j����p��j0����W�a�++��tk�hwΚ!���=ˡQ�EQ���n����5[j/�c���߭�:�}#f0/V9�'�>��$K/�Q1Qz�N�h;�Xa��W�ة���5�NYO�ٽ��e�[q�+���I�뤾�ҧ���0�v:�b1Gju2���n��6�?:�_;���R���/���]�qO(���[�Н����v aɧOz�H�-�x0/X,����G�٘rA"PwΪs�����[�L�m��秚���J'Sü�Kz0�U\荀�q�5�12��hxS^E08������Y��?��������%������㫰8�=s��-c�%��^��A�R����+�s�,]�%�H�/�����4Ӗ����8�Ҍ'��\�������E�m=��D�6���ɛ�=����ks:�|��3��;^l ��wX��@���*g���M5md�{(��#��j"��9�z�d �X&a%ׁkM_^]�0�E��8g�l�u:����-�@��K���cPYV)�D��o#������ɿ&���1��E���1>����Q�it�����p�kmȷ"�� ��B���a�W@�:?9�;+�����z���k��G��Z��D��ws�4IS�3�Ƌ��R�&ue��>,}�XXk0vm�@jE�����%��)t���n��م��7f��'3�TL���0I/�Hi�ޭU����v��C��ieծJ�/��8K�*�(�[� ��ε@�n��]��B(��l��1�?YMLl��&��y���QY&�*���<B0X����Oi;�1�(���Z�bZf�6=���eyo�J.Rg���4e����-u�q��� 9�<M�H�Gt�s5�o^����y�'�9#�4ߥ���� ��JuAV�� ҧc�}V�n��neH�[$yj��Ly��Rh��㣧d�R�=���� ����EW����bA(7� ��4�$?G��=b����7����Tc�ˑ� �W �(7�$,�H�Fj�#��c��?N �h�oq*���0�d���k횈�31���� ��AdfK�[��c�^҅_�CJ(��p����K�a�,�L^]���{��/��-F3�I�=V����� �J �2u�S��X� ?��Ʋ� T��o/=�-],H����f,���ͫږ�٤q�m�g�jS�2I¡����j�.��>��и�B��k�����R� ��I�،�v�aa~�j�`�d��ouG��۳ei:c��v�6پ�%��L��#��8�v�H����<r�-�"�E�"y�VQؿ8�Bm��x��t-��Ѫ�6��z:���EFBCc�'�2�~�>TO����ܷ�l��PX�.M!���x��݄�>'ú��_�'����7۵������E�[����k���ήZ�0H�ӓ�,������I�<��/n��
Behavioral task
behavioral1
Sample
5b789d79790eaac7cedf7194ec9406bd91d1d808d612954dd487dc883da684dd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5b789d79790eaac7cedf7194ec9406bd91d1d808d612954dd487dc883da684dd.exe
Resource
win10v2004-20220812-en
General
-
Target
5b789d79790eaac7cedf7194ec9406bd91d1d808d612954dd487dc883da684dd
-
Size
332KB
-
MD5
4043f211e38d222b34a53603bc1acfec
-
SHA1
b3b3fa780a45486f70a36aa61240828863e9b4b4
-
SHA256
5b789d79790eaac7cedf7194ec9406bd91d1d808d612954dd487dc883da684dd
-
SHA512
11ddb11b8a9d52575df758c8b9a208b0fa19a8a0cbba239abf58255c279e4f3d8789ff44ceb96a3eb05a617a3a057fbd8c1b2d911bfec9889a45dfa1b916707e
-
SSDEEP
6144:VoAkuK8A/pfjhCopvxUikB6fvxKbwQGioFJw1opA5gNmNLRArva8MiiWK:V5nAxfj0Yiik8rFgdNLmvaYiW
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
5b789d79790eaac7cedf7194ec9406bd91d1d808d612954dd487dc883da684dd.exe windows x86
d75b9e28d8132110ed141e69b8691b56
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord517
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 621KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 308KB - Virtual size: 306KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE