J���@lň�5���g����H|4���En;1Ič��"Z�Ra��E����(�T�I��z8�qZ��R>��)�N����� Ae5�U���L�3���lF��Jƹ9��B��s[������ ]�����5W��X�,�i����P��`�&Պ��a<<)y�m>-���|������<���jL*˨X����$���F2��n��m٩ �]m*��<i�N�b/��aVHD�vJ�.e.���I�B���v)�8�O�(�l��pw�Г�a����:�|��K|��BT�]�i7,:��u�����'����+����Xڦ��Hou�"��m��9|�y��k8U�(����n���3#*D����:Du��n����� gj��en0v��*�CPv��<6W�����t�%��=��`�a[�$A�$�1���Ĝ���S��hWN�Ԇ�9H��� �������������=)\�����^Ppu�$�b�N�������Fi�5�ѳ�/}�g��$����:�r�"�]��� ��B����D��1�@G[��M�[��O�?��Ե����'z��$����K� s�Ċ��9��`��� �\R�������N�',�'����K��r왅��,�G��:�\=�A� 8}h�e�m�.3����ԇ�uo���ى��n˴@� �L[�n>�3h��N��!�lu�m�y'@����cw˷1�� b�d�V�oR�y/���n؞X���hj�s����`��Ȇ1�Zn,`YI.�):��@<�`1 �p��*t���-S�o<��v.�+���`�j��%Z�q�y��k\��f���l���?�+]�����CCȒ���x��=�7t�Ԁ���oE�at��I�O����/�R#+�H��S�{j�u-�)+4����P��D����X'D^l&%CzUz^+U�4[��W6Q�Lm�߀��H�v��ב�F��c�DD�^� P�s��//�������j�jR�c�`/�$�麇|���5�E���3�`�k%8����( 4�]�����4G�mqs$l��ƄO�q�$J�)DJ��jH����$^��]q���J{n~|[JYJ7���B!=c�*�{�|*8&0A�=P�}Ck_$�,�e��[�p�x������]� �wu�I�/���v���M�� �,�͎��U̿a�u��I���,��^��)����MI,ۢAt\� S�uK6.���Ȇ �QW��l�ֿv|������S���(M��#r3�$��W+?_p�wC4�Js�`�&�����:В1���r�*��i���b��:�wWZ�K���+�n� �e]y��},]��SjE\$.�o���l#��%RX�&�`חq7�/�L'a�����I�UGw �GgY͡n��q���H$j����,�ÿ�ޞ���9���*r$�@��_�A�A�����3/r�����p��F�b�B(qLZ��v�q���y�QP.n$�:}� e��C���4;�:S���Ȕ���5A�71�4�ik����pI۴m���/7��]LI���+p_���n�Q�j�)�ʏ��THm��`�]H�] ���w�e��^ၦ�$��]�?Te^fl�֦�`�s���%=e̍hf�{2|�� ��I�z��/�l[荌�F~�y�y�膕)�؉:� ݾ�_�%���hwp�?� q�6��F���T�bm�ߤ�I��t%-�mm��-�=�����r��i����З4��,���^���-�?�ʇM%�W7�y��D2�6E� <��I�0�̨h2�&�Z<ko��2Hi�.'�T ԾC�"X�Q�������݀�*��"x�VE ھ�u@`��y_S�i��_ׇt���R%��(�^��U�,/����πt�:ŪMe���}@����r�h�ә�6i�X6�v��� ���؇����CT�=d!h��S �}���f � 3I���m�~���\g�J�X ��"瞣�+z�H���SL�w���E��� _�����*���bm+L��Oˁ�K,�,XTy�ݯ��d볠CI���w�+w�>Q�\�������dz�ȁ�����y��C͊���SA�R�h��ƽ��U|�� l���z��t+��$8*�O��n�+�fo�q���E<H�dD��F�~^*��r ���£Z��d�������=����BC7��_OKbP�����Ym��%ԞA�"�>��s������@�;�lA�o4>$���;�|�����:jTշw;��&�]:�����ۢ���ؔ۴������h�����C<b9h-Ŷ�A]��I�B������f�������V�� ��Ћ��Zp�O�����y*�쒶w����ۛ�ݥv��z{�4���j8Is��]�|�u�Őh��%D��a� |e�᷵L\4�h�1o��y��X����$G�7M6��&�r��i&���2�867�����͵�#��\��#f�� 6��+��_�Z�8�ʘ�-2N��9�i�0H������E�*�E.'}��@C�HD�\Ȁ���%�1㊮]�eSH�MHtE��L�7�-�GI#u�HK.7n;gf��U�q����mv^�' ��κ�I��|fIԽ|j�ʯ���c���N�JR����M�\� `J���K#�o�~��<q�u�9!���1��`��)��q�Cn�b��� ��0�x=����#۩&�0-|�����)*��5y�-���ό��c3������.�C�t���!K�~�[����n���Tv���Xpͯ]��� ����jڐ�/������W�������`f,����Z?���k�y�M]�F�bQp�"m_�2]!Z����Ӵ��Щ#� ��qk�d`F�_�K�J�Q�6u��U!ߔ����]-V�C�[o�it��C�d����瀪�� �P�>D��>�)lH6�;��I��6yj�byıH��m�n�/d���,bn*�rR��w�v�c�R����j�4@_oOc�d�w"�j���xbQ$��NF�4��-\�9�R���*���Q1�&
Behavioral task
behavioral1
Sample
8ae6910bc25a9d2944a5d6fd18898fa62526a072292b7e10baa76de2c8495e5a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8ae6910bc25a9d2944a5d6fd18898fa62526a072292b7e10baa76de2c8495e5a.exe
Resource
win10v2004-20220812-en
General
-
Target
8ae6910bc25a9d2944a5d6fd18898fa62526a072292b7e10baa76de2c8495e5a
-
Size
872KB
-
MD5
2ce915a3f58c56fdf32fca042fe18aa5
-
SHA1
e4a268567c967dd0c0fc118b4ab62bca95a8dd5e
-
SHA256
8ae6910bc25a9d2944a5d6fd18898fa62526a072292b7e10baa76de2c8495e5a
-
SHA512
088186ba826f54a15bb64c0e08d46544d2413f5cc11498bb576770124e71fffdf897e3ff496aeaef23a22e9dc635c59a6bf7406602b4dd9ca7c7bb9348d92652
-
SSDEEP
24576:UbYEQpwnFQIWcpW3zIFCuBksJKi19Wt8stWkda6WYVo:UbYEQpwFLjp4EkHi19WtbNaCVo
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
8ae6910bc25a9d2944a5d6fd18898fa62526a072292b7e10baa76de2c8495e5a.exe windows x86
58011beea1677b055b8035614319787f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIcos
kernel32
InterlockedIncrement
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 792KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 860KB - Virtual size: 856KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ