��ރ�i��1��BG��g��\��=+�t]���c�����áW\S8ʴ�l#����_���|�b���T�i0�E��]=F ,Ȩ����9���(CF�Vևmr��Q���x�R���[����>6��@V*��JpK�DѸ��+��W2b�>�xLYA���L]�v���0}9;C#/,1fl|\m���:����Xe��0�&zO3���G���R��XbR��r-�X��mxL�<n�F]����S9{�]e:�ɳ�e�}�Y�(NKޠ���kE�A����U�[��Z`țY�$��/r�14������({Gmĥ��<Ѓ#�Qs���1> �$a-)Y��Y���`XUUσ�Ȑ�APS����C�P��dk�t`�$@i�Z���Ik��%9ּtg�m E[������q�5��D�|K�Қ�_��Ս��y�&�36�0��>&���Q� Xm�=xf8g�tyXڎ{F}�B�C�W��� ׄ�~�~n��n����t@8�2)��NX���Ә,a� �f��%L���b�5�����>�۪a�C����P%�1��ƃ�{cL^�����Wؕ��a�~` ���j�S�u!���6�n�&����.qJT�����r�J��N]�[�Q�zICjўJ�z�^۠zw� ɫ,��<R\�qa�L�ܢ�4�Nn6�2�|mj9HkD�L�������ʜ�ШJ��h�> 5���.J��a�"����\Nn<f�U�L�c��e�=rA)�!��t�Z{�e����^�|n�������0�W4�8=^���l��-�Y��rP��9%�7Z3�W0���A�+�8N�_����?C2<B��R�yKד����*�6�j"<ר��b~���Pᎊ�fuE��<j� �����6���Ea��<���9���J��[[��t�+���Qe<��i���U�.��3y��ޱ�a(Lץ�y�}�+n�*X{�����x[��K.������ �q�!�^_�B����_;Zb?>�a�ߥ&�XGl�;����kc�+1=�J��E������Sp�b4C�T*�Q͞�� �]�<>���3��-�Bs��ɰ�wx%p��Ҹ�ye��WIlt��ow1� 5��z�`C~�?�gj,�I�ⳅ��F�\@����� -6�X̍:�KO�;�ɪ�7{@�P���_�pt���9��*"��^�d"��V�����:����`_0V�ڻ�CAda����L������B��;9L?(�����0���hdz�i��G� �ؘ욥��,�@��7��`n��������[{��"�q#p�?��.V�1ysLUҢ���W��,GE�'����Y�h"Ї��˽֘&ۈ��X�s����v�;����Rb6�K�L��l�D�Q�y�=~эk����ئ�������R�n�E��n��e�zO����j��'Fk&���&�[dnx���2Oa<m��E�R�2��u��v���N�AM!����Jq(�4���%�������M���^TU�}�h���r���B����Qx/�1�<���4)� J�e�`Ί`�5�=�]k�u �ă�~�Y�Pu&=��hy/&]���#ޕ9Fo1�.�'h_#�6{Y�w|HYqH���a��1̗��c��f7Գ��U���3��T��#���* ��}�t�O�.��ҧ�{� '��{��V���:Y0k��e���\� ���vt� R�����Ծ*|�P�7+��Ec�+�tPrP%�Ù�Өps���g�ԟ�oE�Ե��C���+��;�|3��9����F�~H@�q:z���9-�2���i���t�mOm�Ʀ���%�?�6N"���N��!��[������.�Qf�L�)Q*J�[�����8�(^M�1�C�6���)������oQ�S�}FFT}����+�����},oKN����l�~���R�����t��f�@=��g��N�\�������(`9� �B�-��<�7 ��1�dwU3���/G��1�&Ɖ2}ɰ( �h��T�^J>���Z�%�bo�w�is�^�ZD2�'��""�$<c#��n�i��6��T�4�kʊ��-����׀7�[�$����֯��p�8z��tW�X�w����t��_9���� c��a��Ue� W>�L/�J�G�Xp"�K���Rn"��W���++c��0OV�H��D�EZK*HM���@�#�80�3���,�V[�8�l�Ϣ�x$��8��58iVw�=�{Z� ޕ�C�TR�&`�ըs�h�m�,vQ�=�s.P�S�f#�>�|R���=�ooӿ���Ƥ�n5���b�0�ӊ!�㉏X��TIdA��W�B,:_8P��N�|�����d�ۼ+�����A#�v����L��@�7�� �+��(��\?u�X�Y�����H��u����H0>�>��LK�ıV!s6�" (�(��@=��[�&���JS��Vמ�Qͷ�끧�|�M�� ���s�l�!k��06|���e��:8�G�g�ph��t�@#�>�� �gH���⊋=��կ��a�u����-#�h���E+df �4�S�e�C(zy[��U�F�U�~���dm�?$�h��Tu��7�%�c������/I�nr/}� �q�3c�qۍzn�G�W�b�`�A�?�:�k�k�@�R���E�۳��o� ��i��^M_џ���m�Qa��e�,�A^���D�����3�������w1��v�(|Z��\�i���uP�(�IȀ՛Z���)%�z*^��sX� F�����<�Y쀪Z���ѥ0��[x4T�Gjp����Ɠ���_DtH�1b���T�Ao�'_�^�Ն;<$�"PB��v��A�����+8�j6%t�G���}�a�W��B��֥*�w��9*�:`�4iUj,�@�{Uў�o���ؑ�a)~�V@IDJ��G�MU���K��嶘�Ƌ cw?���G�������1T������&g{�m�}������~K՚�5�|�|��(��UI'� ��V1�Tv��b�Y���%���< �O���T3�� #T��#��[Tsu
Behavioral task
behavioral1
Sample
da37a5521526381964fc2aa9457d48ed6f5a9bbcc7761c18392579e6be8a4324.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
da37a5521526381964fc2aa9457d48ed6f5a9bbcc7761c18392579e6be8a4324.exe
Resource
win10v2004-20220901-en
General
-
Target
da37a5521526381964fc2aa9457d48ed6f5a9bbcc7761c18392579e6be8a4324
-
Size
684KB
-
MD5
83bf9d3bc1a89bc51b95d2073d390948
-
SHA1
7471e81196a160db5481f61b1189f569d8da96d5
-
SHA256
da37a5521526381964fc2aa9457d48ed6f5a9bbcc7761c18392579e6be8a4324
-
SHA512
8fb34bbb30ab52849bba938f271dcb71252b89def4ef675fc034ced3a9b27910a2fbec37de57de0c8f81688cca3cdc9e556499a4b2692ff97258047292f0aa79
-
SSDEEP
12288:nsJmgMn/Hj7N1/oB/nN1OZaycyOEruNBZeJTCrJlXRra99OwECM8zM7O:s9mHj7N1glXQaVGcBZVVlhY9Owo8zM7O
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
da37a5521526381964fc2aa9457d48ed6f5a9bbcc7761c18392579e6be8a4324.exe windows x86
b928e5004a193a5a26fe9d6a25045f33
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord632
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 625KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 668KB - Virtual size: 664KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE