T� �B�e�Pn-ǁ�m~����G��l�`4�ʽ�s3����F��M���(W���C�\���w����]vdq�@�X*Տ��vG����� ���6�+�.�R��D���BNq��-# ������V��iD�F-\9�r��z|��E���h��0�^�`_�ۊ�c5�������"�FM���o��6�o���F��N��[R}. �"bQ�j�́ƗՀy�X�"���B�q��lz�����3Q�람W�I>�@���/�SZ�(S^�]�t�6 xoq��+�Q���H�pp9>~ʆ|>��^�9�M����4N�uu;C��:��2%�\���uR:I/�de8�^��ܡⶄHwo��]Cm�m�%�m-6u���������8�} ��N�7g]�^>.�آZ O����^�~{��J�AuH�O�S>u�w�=N�MeoSv2z�NO0����H0 ����F��B~�y�kb�O1� �<��>������}~w���2���jмez�;�c Ϛ�{&#�T����,�+B~B���$~��!xf�)&mc��4@��U�Ux,l��-�֎9��k\��N|��AR�Y�k>���b��I�NB���xB�$���p8=������R�#S(M�eD�y�q)����� 4��,o�~>E?W��^LNދf,�>��� WS�ht����'F��₧�sY@/���sO攺gs?��ľy�1D:yr�nɴ<�g�@��M3�³�:dL�(P>�Ei梚;�I�i��;��������~��m�<���� ,�A��`0�Ͽ�k.���fl�,L9��s4{���vM�{�)yU���q��]n+E�gI@Е�������`�3�68���7�3��i��Pp��m�����}B�З�bTPX��Ϙ�;tWN��H��<�H��G��s�>�X�#�W0������3�ld�������^��Ȅ�h.�����������3�;C��E�@axנ�'ɖ ���"wCyA�*����Pbd��x_J���C2�����6�A����Um����~B�Ӭ�a}螄�!���g��n���"1Y߉5�� Ი�$_�E��!�c������s�H�3�(�C��A��_�]�s�`BB�AZ(�Kk����Eޒ�G�R���DKo�����J�J�ǵ���6No�t�̪❀(cvT���i��T=�I#�V}���ӟ+tY�8����{��?�q`A�%O�a�t1��Gtm�{��$'��)��&&k�TGȐ�+M�m/��!Nm�to��w��)0C؎`$(���U~���U/�`�Zӕ1l#7e�*R���jj�g�68��M�t* U��(#ta@��^n!���,o�v�,_)ޥ���~�N�0������`wJH��]�Q��%N>�b��Sc�z~��^�0���{<0F��ӍtcM���(`��#�}K�+ ~ЄX�ٌҩ�6imbN?Tus�h�aȜ|���M�11q�ފ"?>h�&��m���,���g�y���:�>�{�y���x�zf(�͖�9�W%�lnGŖ ���QJjW�Z�����\͙��+�Z�I4b���v�㢧 KD�W���ݧ)5�Z�r�eZֻ�p��E�܁c��R��.x�"�g!�Z����>�I�� ��{I�4?QX�R����?Ү� )T�o/�i��:] VrӆUG ��- �X㥎t�ĆSWfD途U�e����3r���(1@c5E8��Z&`v��^.�O}��&���H.���(�u��N��}a�ɺ9�O�=�����讲�ݕ��}˱�{'�Ԟ�q�JoX�C�_�[:!�,����W�~�`�'Α�K�fmO�ڿH��ȟ�9HFو��0�b<-���D�*Svt��4 �l�!E&�tj�;f��8����K����jo6�WE0)"�L5 ��H��� � ^���u!L�EN���n���$�ޮ6A�w�X)�L�~�;f�*p=f突=;'�W���4�{�5��17+1�R����D��6�r��Q��p�ag�����b�\4mc�r�� [G�Z!��0G{Vhe�>@ ��~g{s��%6@E��w�$�N�GW�\s��>�n~���F��U�����.|��İ���:� {O�x�� T���:��i \(�n�^����C۱�`��[��Ql������j�<7�vn� 3+�8/pHM[�C���a�CY��r �F�ݿ���V���χl ��!T<kɵ�]C�B��R��<�I��mD3��p� ���r��} �IDKh�U��c���.'S��Q!8 ll����B����%:E����L&�/��O��g�ǠQ��i�b��:�e�>e@��:��~���������s5�9c����ڄw�g;�A�q[��Ƿ;͗�ev���I`8}�Ŕ���!�e��Ӂ�#JK���.h6����>���$�>���ȶ~�s/x�ǀYw�������?*��{{�PV�n�c|���y�գ���$�^x��=�<3B̎ձ�� (S[A��u�Hg7f������^u�}l�>�1c�A� \}�& B=vddK���e�ff�L��̺Ȇ�����N+��� �VNM������^º����Twom!p�� �� ,���H�d���Z,c=2>���� @���@�y8PT`^�=����x@~g�z�i>>�@�(��"�W�iz-�[9��sA9k%�}�4Q�%�57��8Ej��ͮIZA3���F������:��C)] ���v#W�h�8�h����J�٥�#�������V(w#@�p�y��Hr�K=�5�:3ݥ,��c'L鬟M&��1�^����H��v� /�M�|�i(}�|ڢ�,�f�}�l�$�s�_��h��g�$p���=Ot&�Gx/�O��6�ng�%������mD��?$�ڌ+ەv}�{��.�<|n���3,�AY�r/!�ic���;#���da�f��`2#�n:hZ�76�H�f�<w��6�<��o6E}�CU�c*�e�tG]�MH�uO�[6V���z��2GY$���:����f�+��9�ϸ�)�u6(� yR��
Behavioral task
behavioral1
Sample
c925695cbd0a4ad175be158ce23862902048197bcff6691fbb9407abfaa0ba29.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c925695cbd0a4ad175be158ce23862902048197bcff6691fbb9407abfaa0ba29.exe
Resource
win10v2004-20220901-en
General
-
Target
c925695cbd0a4ad175be158ce23862902048197bcff6691fbb9407abfaa0ba29
-
Size
236KB
-
MD5
0fbbe74ddb9e72d3b1d506bcd0d483a0
-
SHA1
7c68d8e4f52790e30f38df685adf9b13be45ba0f
-
SHA256
c925695cbd0a4ad175be158ce23862902048197bcff6691fbb9407abfaa0ba29
-
SHA512
3e4c52e99a269f897b6aab276a8f068ca095bca1878899d712f9da47a9d1aa90b422bd01e3e31d57db17608f42e56820bc07e3fffa058007bffca1713a2838c8
-
SSDEEP
3072:yhXykpQo5nmMxWYdBVVzedoP7KGr2j+k0TrFGy+nxHGyh4YAifv8ZHAG8skKfwwz:Clx7HVzedoP2GrA+kqrDUfUlAGvGL9
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
c925695cbd0a4ad175be158ce23862902048197bcff6691fbb9407abfaa0ba29.exe windows x86
f96440580f44ff5191d3849e5b520878
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord600
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 224KB - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE