Z��R;VXRf�b��`�����ؕ��a��9^�>$���c �MTcb��z�Ӌ�T�y'+��&E4�T��=ȯ�<����ۗ��}�� 7�dftЁ�d�B[�@��s(r5����+ۚٔ�YO�nz&���L~x�"��{c�,D��r�7�K#���ʲ�F,�i����N�^L�����)�ų�n�����F����(0EA`� �f[�˪{��*��`q ͦ���=!.Kfi���J�s{����!u�ǖ �2Ĩ��}7�,����=�EW���f��66i;\�_[�{�ɼ`*�0�i�O`1;F_�*��>���{Cs�U�����⤚���J���N��s�{*�����:���1ٿ��6��D�n���%��@������8F���1b��a݊�{���e| ����݇�Óo���]:�Z�ϡ�ܪQ:�������(��:�W�,JV�|�+/),d"[��� B\��V�2���H���2�zb� k2�P{����0������r�w ��m��N(�fC�~��1��c|�5��h6,���M�E���� Y��J�$E��XƷ:_/m���;��x�[��oP:Mנ�;ĺ#��d���,���oq7�f�[Dd`�3�,c��P����4��;�k�,�)��Ѽ),�q2s�0�(�����MW@�W���c�8�I�UwjY�������8υ�qH&��������'d�k��mE�J��������GO��ʜ��W�C�6�x��}�2����=��a��CQ<JV'���̏�y6���B+�NAżru\��_;X��U��ۑ��d�~�e>��q�/w�k�đ'� �m�����ǟ�*L��)A;g���m���-k4X��g[��ڸ��0�Ȣ�� �h��P~���:{du^2]RC@E2��:w�U4�v���e (�(l �bxjkf~u%W�i�����/܆�^yNj��=!��Nr��A����i��RC���uo�ϔ'��e��d�` ar_�6}��DX�xG���r�Q+⃗���Y<��>TmM��w'I�u�^]K'$T>L���@s]�h B⊭����c���m'�T��1�Kޛ�]�H@:�[l�w9�M��~a�9●�+=c�� ���m�Cͩ�-����P6{�pٵG����Nv4ƺ�z�l -���Q�����u$�%���:ޤs�����/� ��΄ �s5M|�[��qDžRe*x�-b��UGT�����P����w�Zq�N� ���0�XL����ep�1�$���0�k<&����p(���Ȭ}u�=����DW���-��%s mIt�L�b6 ��6)�����eJ.;������fN4&�K�P��[�\��Fw��7�>t-{=� $O;vE������$ڳ\}�^ ݷ�YtW���T�Ez����� g�P�����.$G����"�/ d|ݭ��MB��\���㑷����1K'*4"aO����_����KK� m�"���2C�4�;j�� �w(U�[�8����xH"-巴�^2X+/�-����z���J�<�I�=a���Z�7�aWw��O�۽�������t���C?bc��;9�^�C0F��--��w˻]��$��`�٣�oi���W���?-wnH5��� ��䠕:����K��O^vo� C)�f�VV? � m����ڐ�NA���O"z��6���?������4�0�����"�X@G��lڦ�=]}�}�|+���6��s�}%� H����|�[�ĕɋ��~�@��w/ h�4��f��;��+~O ���O��ν���O1E�*�x�WXw�ќ%i�.t��%"p������T*u���.ʀL �$�Zh\)vu�`(�4�����0�;i�j��s��)�cŕW�fp�U3���'�����q����-�),w-�mK75���Pu�r�J\8�,��x;�ch%��XBe��9����d�q�ƈ2�\�\�L���b=Vf�l��a���g�`���]R��p�r Gu�j��IW�`>�d;��^��߂�C��?����S�7VO�h�;�&¹�H���ěik%��J�)XS�KM��%=��tY&�|�mT8�����8Ω8r��]����4�ӛN�j�H�yZ�7�"�RN�`�,�4n���wo!r�dZ�ԉ�ߠ�ϧ��?�Y�+I{�le�g�r�c��]$F��<N����>|>�2�6��Bk2X\�D�0������㣫#�P50E+'9��/u4I�~�ڰS�I���0:A�s���^lO�X3�j�@�;�����,�)�����\P n��*�>2k\,C�r�27�c��9$3� ��ǍO� zy&��©:v��!�����'?Kɗ�,�ݼ�����%�K�P.������ֈ��h���]�-N�-D=4}L�K?G��������/\M��(ۊ��/�Ŧsw`����ŧ�ľ��`�ȓދ���%#'��s�Qy���a�M�qv�i�v�����w����^z�����X1Mb6�n ����O~Pa !�Ԭ:&)ę��#��Lƶ��[�D�%�>�؆G��B2f�>��3�H���>"S�<�""���]0�u^���^�RʮE��s��LAJ���jbA*�~�I�]bI���}���9h�B���+��K5������ȱ��M� �71���5��Ҧ.}J9eR�>�+|f.�Y)B�7��S©|���죨R�#4����"��y���,O+�@�QJ��1`t��� \���.��������G�NMpn��}9�Pd�'܆�o��7�#�֗q����=��F2���Y���fW���x���%}�Ȼ�\u6}]8Y��4�ak��* ��b���>m��;M���Npڧ|L m�$��z�(��e�e;QeVg�K�Ӄ/�����M�HV�����[��h�R01C���Y�%l�_\�� 8���@S&��~��|L�_������N6�{�I���¢?J��/��OR��#��vМ~=�/���-�TIt5�����w�1v�%�*�}��|nb���_J�c���s{��ٛ�?
Behavioral task
behavioral1
Sample
a315e39dd1ba6aaf6d0abd8b578247b59aa9b935716ef5ac4f47a0d6efafbc31.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a315e39dd1ba6aaf6d0abd8b578247b59aa9b935716ef5ac4f47a0d6efafbc31.exe
Resource
win10v2004-20220812-en
General
-
Target
a315e39dd1ba6aaf6d0abd8b578247b59aa9b935716ef5ac4f47a0d6efafbc31
-
Size
228KB
-
MD5
84c97829f49558567e378841ff2fe368
-
SHA1
9204175bad433d77d8b41b68998ebf5cb6c1f11f
-
SHA256
a315e39dd1ba6aaf6d0abd8b578247b59aa9b935716ef5ac4f47a0d6efafbc31
-
SHA512
3f6ca8fe0d99f45d8db309c5f7c0f2a63e5ee7d03003c4dd0c64739840013a1a414cbb04723ca54969fe04b777bccd96965c4506063e749e47b0e4ea9961a568
-
SSDEEP
6144:spq32QFOV4k/rLxDHvjABMwpOoHwfPo8Wea:s42AOL/rhABKPPo8We
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
a315e39dd1ba6aaf6d0abd8b578247b59aa9b935716ef5ac4f47a0d6efafbc31.exe windows x86
7e919fbb073a457b0a709ccd0f111def
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableWindow
gdi32
CreatePen
comctl32
InitCommonControlsEx
shell32
Shell_NotifyIconA
ole32
OleUninitialize
gdiplus
GdiplusShutdown
olepro32
ord251
msimg32
GradientFill
Exports
Exports
Sections
.text Size: - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 220KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE