]E �.9-������ ɤ����x�� ��W�ʻ�B��3��2�g��r���n�Fo��|�z"~�u�q: F�Ӄ�E���Y�y�����1�R�:�n3����>�t������nC���%��ٱ�����I���@�ݰ��Y���{�w�c�_����~1��"�x�b�(��0���mΓТ�"?�'^$2+����|�!��ފ��0��*i�Q# ����� �>#�{��5������$����y��W���q�j�6��t�]�g�o�&�&w��x����v�<��� �bv��{DM�C��Lj�wDz0mv���e���&����2��G�����x����2LS�)��- C�ި����Ep*9�E�1�%~�Yǻ��rj�j��k�^���˾���T�M}e��+v%5�����t���ۻ���`e|Ҽ�?lOD��w>/lЏN'Lw�s��u��,mDyU�Ym�b-�ʹ�Q����J�"/�$.��PD��S&�9OHB�<h)Eu�AUqS}LQ�4�P��+�K|�c�O�i���v�TX\5��ѣU�ط��D�&ջ%'��-��TT�������Sp���|.Ъ���<�k�s�ͭl䁩o���а�u��p�ƹ���aFұ[*Q[�:!F�v��qc=@]�Rθk�U�j���W�@o��˷�-�B�k@[�')���A�kA�qW�q��m��i�1C�@��Z�ՙK�#f �#Rٯ� � xZ��~=9�;�z�r{�`�LɄTD�XX���)����eg�8�/�u�j9�~ ����f&l�/*�>%#��4̍�i���s�Y5\:��ۂ�A�� ��$۴�B������.��<1i�ܛ�����(`�$X���-F ���d���T~ Fe��q�b5)���!��� ��j���ՠ+��y���l*m�ه����: �V�r ��v���6��\a��������R��LV)z��E�K�V�ՂKD_�wL��ON�9�^�놱�MZ:�[���L�q���*�����aF�����q�x3�ln�1��V�<nJȯz�_�txíabA))��U����V��6��,DsT��۬�}��0i�ޅY;yd�������Z\:B���T���A���G'����ݫ��|������gE��[�Iea�2�T�k���p'X-����=� Urp�M��>��hX�0�g�5�V��d؎YI�t#e93Y��[�NP�Oh���P,v�%�α�K_��H��7�rbJ�%*�,���D�n�� �e�CY��7��'�d�R@��P +�}U�9�7z9��I Ԓ,��;(7>Z�;VIGg�l,��\�x>^�V��g5�K+(�@K�����J0���a ����IrB�s&1BR����ƃ�}��e�J�>��t�K�'��E��-#�&��od��m��f|ǙO��/ ��,�,S���6ǁu�{Q3l��lx�V�b�Ͼ��b�%|�/_���DH��p�,�?G���T(K�ɽI��4kwt'��#ȏ���Ýy�c/�Ow��4���baA5Ίd4�y�ںzjѲ����*ϟA9�����kr��C�ڳ�����d�����ۦ��90JdbJ�i�Ѓ3r���m�צ̚�����ө��ܯ�.)���A�����@o��� �]�0��U(�������G`D�УBS$�jY_V��?��e�ҧc�WiT�$#��a���������d��˛�8������b���9$�DO��p�}�%��WI� �(�ߥ�ޔ�Β_��|6J�e�j%B��+#$Y)�I���%���� ���(��c��zb�c���=}v�1��4�uf)e�}כI�x�Â��ё?!|�M:,�R�^\��>`X\W��0FP���KWh���u�i���g�0^�A���x��9�u�.q�:����LӔG�~�;A�T�n�Όr�� �c��������hwĥäPF��&8�h*5�j�H��mmf����l����Dۙ��z�t/�T<ҍ�RT�PB8�Æ�:�&-v3,��{��an�)�����ͷ�`+�4h��&Y2��Z�������y0��C��Yp�)����f�Г�������C�1��g���?|v�ͱ��?��K�h ��/�[ת/��j��H�<�� �6�PL1��[_R���(3{��w� �ƞ�!ju�Uk�f��v�6M����lv�L���������x)-%��G�+�:���$s�b�{T_A2��¾���������.�f�ʛ�>jz�83�>��2쏞~J��B$��N�������K�� L1�s;�c���Ԑ���-���ó��ûPAT{#GY��قKU�a�3A��rx�(��M#�j�R۠&��{�2��7��֗yP1���Z~��s6�5��B�;d�����w�����u�9K��L=�7?,i�Z�I=B_k�A �Q̳I���?ɫ�HЏ�����N�k�H���M��N�)� ����ކ�@z9�rS�V�H����.����6����� ��O���^n;��'�S{��]�&�.�~�&�asl�T7;��)�=�P=��;\yjgo?Bt�u�YfUB�.)An磞�hP��ͪ�q�_I��"������TT�d4�ʢ��ux��K6 �||�����̐P)q���كi����ы0�s~V�X�EC�8%>�H�w�������9�蠣��J�":�}�l���7�Ɵ�f\:����w�0��έ�[�M�q6��!o��S�c@�sl[m/��]�^�x�{��-�ԥ�����8d�54+���7�m�A'eM�qY|�Ḑ̌��i��{30��iN������U�v��6O*��D8ݍI ��j�i��)��i�`�@�2u��"z�W��� �NJM2��G] $��<�!��W�L?eT��W*H��Ŕ�$ۅ r�2v�'�2���|`���,2�4��:J�7%e�� � �L9�]Y��yc�(�w����f��i��S.����r#����C����Wz�>K'˓���7�x4�A�i���B���&Zѿ1�= �.�`��η�EHd��۰�1ET����t�
Behavioral task
behavioral1
Sample
ce9ceee4ff99c91b6864a93702ead1e822a2842606e3ae52f20b15e0f374a900.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ce9ceee4ff99c91b6864a93702ead1e822a2842606e3ae52f20b15e0f374a900.exe
Resource
win10v2004-20220812-en
General
-
Target
ce9ceee4ff99c91b6864a93702ead1e822a2842606e3ae52f20b15e0f374a900
-
Size
624KB
-
MD5
0b5f23ef6d9e84f03626de4de033f460
-
SHA1
ba909b07f4c9c6ff6fd516687f6ebee8acd8f928
-
SHA256
ce9ceee4ff99c91b6864a93702ead1e822a2842606e3ae52f20b15e0f374a900
-
SHA512
6fc62fd451337e7014377dc6f428c692c30cf029904c6e4ae1d6e5bfca639e2d646ff258e0a2aaba18a46f2fbcd8e4ffab957518816b6c82d953c0eac03331bb
-
SSDEEP
12288:TFwlzelDenJs3QCaMlfomTc6KQfFxPplDza0FAW/ECQKTbr4Atbh:elmDgY/pxoocIfFN+0S0/r4Ybh
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ce9ceee4ff99c91b6864a93702ead1e822a2842606e3ae52f20b15e0f374a900.exe windows x86
bcced469e65354473bde96b9ba460f9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord529
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 608KB - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE