����D�rU�8����Ҷ��}�>P�v'%�Lj�5���W�r����:�P,%0�p���bP�L��ܦ��SMHv x#�(S��*m�"�D�Iߜ1�ڂwd��jԀ�6��ɟ���Mz�Ȋ�S�6��֑�L�����N��x�R��L��/1),ik�C��-�[���|�G$�FDG���J��t=��!GDş������V�8��>)���hH��Ӯv�\�����`��O��W�ܥܦ}"�?�#<�Z(�,��О$#1�`���T�c��Y�ܥ�%�A$0b|� �z�s�Y���n`B�ϰ�u�qnO�?����W4��/�����0�s<CR��4 Ƨh��g�MS��2 q��hۜ�L�L;�9��&#/$����m��t<j���W�|�h�^$����d:�������7��\�p7����0m�S��3�o.�t�����^�h��Y8���){�c����'|~�ނ7{��Q�@Odn4 %���(iʟɊ��փN\!��S����G���=�($��!�}�W�7b;w����L���|��h[���B�I���_��x<Hs����~";��Yd����'V�.u�,ϫ+5/(�-4{Q�%A��u��{=��ObT&��L�Rrp��W�3�I�+�tSHzI�q��`���T&�30 ���Ċ����t�ulb9�F�*�O�ܬ�EA%�P �@z�(�c�)����ߨ�"`=� �%#��۳�lY+I����� �j{;Cؗ+�,������K�b��iN)��������U�i�h1�gM�ġنRjf���u��f�@�f�zi��(��� J����M�*���#㩂l��)J:ې���f'N۵����북�5����|��ƩBG�T;&�e<Z�.7NIY�E��c��{?�`�_GY]���"z��!U��W�J[��(r���"��W9�:����|����t��H.3'�4m� "cg�ßݐ)O.'v�Tm*º3Լ4&��rxZAuг.<�� %�D�/���E<=!@nZ��f�3�2�b���Gd����H����Qڕ�d� 0}��g�d-7*J :XMl��֧#�1��p�fc�+���(}mD�P�J��V(�����.L��}\�� @�lXu[����������ة�h��ȱ��Ř�}uwq���o��f[ɋ�&��]����n��3��2���5����gߞ5��Ơ��_�!d��(�=�=j���ojP��T�mkď�: % �pI�HԵQ�4��g���S�mE��*;��?�A��~b�ф*D-j��7]����]��="���}���e��&l8ў�W���1��(���H�=F�)7��ܲ�������ë<r�]�e�$q�Y[���Ғ���0쾄�'㖨|Td���h�g|���__��ڳP/d�N3�fA�p���U�wd�>(P�O�z�VP�˷���X���8d�d����@�2� 7��""�F1��$T(�O L�`��Vp�* j,�31h=����A#Ga����]U�EW��eO�_2�+P�Mױ ��b��~���H�K�c/��4��\�pIJ��c^�%O���b�^���6��$n�h��.���b04� �<�H����ڂ��5ñʯ�M�8��i#��.ذ�mLU<����t�¤��h�&(��A��> _�G��8�O��@����Ek ��{��S���X3=���1�)SZ�8�n��~};�D(y�l�I#2C_tu�����2��ݪc�-j�c��43����>p��K3��Ы��Bь����p��#$�����w�ٺM�jvO��JV�?�Ns�����1�S)�(�/9Z�j`V1b7���9��}�[=��`[�[Q��3������t��L.��r�9���1tT�0MȨ�U�-s?�E�b貹�q��.��v�O�- <���w��/�7kºܳ�X�M@���1�U�9f�ljW˽���s�����PY��Tu���$���1���iq)&P�u�O�ۡ#,| �� ??���5ݢlդb�q��|Gz媟L����s�Sc����FXЭU���d��L��[:���B:yY\�#��3og_nǼ������pD��<��G�DI�U��R*C2x�@��%S��V�$ʨ���P��N(o"��M>M�\����Z�T�|{��;:����� ���!u��)|�q��Yr I��������6qVA<��F����ro��f����'��dNu�Fn�c��nCX�5�����ַ������h��-pJ�Z��|�����h�~M�U��x#��@e�Z��3�pW`0�@���$��9b�`�*�~o���<7����&���~~�`ַ�ݕ�kܵ���mVURJ\�E�mz��+rԋ����S�Y� *ʦ'���6�&�4���ի���;��D�ى?F�g��v�-� ]vx$���t��~/f�U8<u� 7V�+__6= u���b�体\eZ�3JX�>o��y:���bz��㒫x��y��Fzv"x����� ��XZE�]��:��:�~0"a8�$�n�Y5b��+����&�'Hj �4u(ԝe�Ф�Ҏ�n@^!/4Ч��}d:"f�Y�����*_O'��Ww��b��)�mԌQ�6�.x���&�ڗ�z�[��|,fH(ɗ��&=�L_�Ժ �:�?�b�RPż�(���vz@(%ۯ�����?NྦྷΣ�{��!hV$���1L�>M��; �mڑ70���sfS�]��QK�p��bJ-��r%����S3����wG�Jm���������IG/��`͗J�t(�} �#�}HR��yZ���%�+Ȗ����������n�$a�@�33<��Y%%M�!��x���������g5�ci�y���[�X0��@���z����rM�ؤ�d��[��ȥ@�}���U5*�Ws������'����]�4��Õ~�u>��(P�[K��T�O<Y鑥�6�CFx�p�Z�_9�!���_q��b���f���BNoȤ��Z�`�]��S%�%�?~�<�P�
Behavioral task
behavioral1
Sample
bba2002cc155e7be72e1b4ba3aacf980599967e11d0f3f9ae18aee1ad027a75b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bba2002cc155e7be72e1b4ba3aacf980599967e11d0f3f9ae18aee1ad027a75b.exe
Resource
win10v2004-20220812-en
General
-
Target
bba2002cc155e7be72e1b4ba3aacf980599967e11d0f3f9ae18aee1ad027a75b
-
Size
552KB
-
MD5
0cd33be1333d9d0b750c2f8ef75d8e60
-
SHA1
572ad9f3ec16962f9343c950a96d1e2064acdf52
-
SHA256
bba2002cc155e7be72e1b4ba3aacf980599967e11d0f3f9ae18aee1ad027a75b
-
SHA512
32228f3bf0ce50a4b6d0df48258e6670a2c56e47b23442e6ddb7973bce2813df1bc2d666f3e25b6f140a0e05c54dd35aae20c6f6d90d0d445d0563c6241a62f6
-
SSDEEP
12288:/uLY8VilZaEPVVeDWIuj4K1TIisvMLtbQxDO15WXUT6:/u08VilsEPeDWcKGiTdUO15WkT6
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
bba2002cc155e7be72e1b4ba3aacf980599967e11d0f3f9ae18aee1ad027a75b.exe windows x86
82922cc468979f0c2bd36ef7601ab33b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord578
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 536KB - Virtual size: 535KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE