9yF������~\�7qK�y[��Хk�S���A�Q^���u�����ysU�����Ԩ��nR<Տ����bDn��1 ����-�O�>�'I"�^��6͔�o�_�4�Q�d���Yj��2QZ�yw|lG��}��V�r�3����������&�����$�$Kfh�^Q��xsK���յ>H����-��c��KZ���h���X��8̦��@��d����z��x� MIn�y������'�m��{1���l.1�|��K�:�S� i{�ӻ���)��y~��V��=h㈦��V'�I�zg����/�F����n�1,3�g\;;��H�gPK�� ��P����x ڴ�+�В�P�i�&��䚀8��+��� �5S.z��4��H8�!��[���X(5�,�1zs}Za$.�;lJ���b#���l ��x!�OեKF���_R� ���r�d;q")o� �lkm.��;��N�����~��J���m����EU�p�FZf�e��^���f���8]'���#�+�b���N�|� �����=�b�\�#��.@��������*�HB4F2���d8�*�ܯ����ٞ!!H��ܽ+`�M,�RW��TCW0)����4ABF��8�6�]��<y���(����?9��T�S�Ŋ�*ʭ �b�9 "/h95�-f&Ʃ[Rl�$����C�o�����������0�li!�bc�:Z�����mAu?F~q��nfYT���p^�ct|j��6����xV�D���3��9V=臇%��o+��V .�^����G�����O�$/vv�R��*�t�a0��6mFY���OL���&�� ��)g����g_�b��хf�o� ���8$�J�@�S�fd� |/82" ~���W~ԣu7�����)~Io�� �2j�EZ���Q*oTFmBP7����J�$>5�kk�(�$9��]��❵��kB��ۣ��Z�y{����5��&;����a� uʃ[W����Є�U�FwXF�?cV,N?��<U�x����Ki�$��E��������+$��Y�Y��/���!+[|�����I��ׅQ�;�\ ��?�� \���r�����q��[��H�I`>��q�Z4G�����.��<���5�a�D-6i��@/T";�gy�6[>��]���-�j4?��c����r5%d��P�J��@~�Wh��g�d�mt�%�3<��U��T��ҷ�cƠ,���U�Q�����W���#�,��'+��P��G�K���K N;`���~�y2?m�/��<�r��t~�ڛ;Gt��tD���E�����J<-}%��bw1ؗ��7��|sσ�t����,W7l����l(XD?ʁ���?�<E��d�:�F��5�t��s1�F�W����svgRsް����H=� |.�D� ΄�����D�۰�$����/����3Y�+���x���3��_Q9��r��u����KA�pgb���;�Z��Z �F��S[�`!`��}��_ ��Fg�J�Q �.D�։�Q�Y���x|�ۼ�������n $�aA��jF�%Q���6� >���ݯ���?әn����x�aԚx�f��e �� �΅?��O����Hz[���6�<�Ϋ8�o�����i�/jzW��';s�_�1[�]��G�â�H�w�;��Jj!�˩�l��o��mק�G T��%�V�՚����3%*Fe����{�BS�_yvj�Ӣl�æ-��IR�q�ui�`�#�`����{�ai�Ӷ�V3K�q��En*Ȑ��x�Ҡ�Q��O��N](��h+nJ���$��Y��-͡���t)�ƥD*>�a�@e:ӻ���Sb1[�w�D�&PRQΆ�I ��c�8mtI�7����d��y�X�?���gz�~|�L6�w��'��*�vL۰8�{,����:3��⾧%6�ql?}��R���ū��g�����ߍM��]%���AUm�J�E�|z��];� Ka?��_����($� U'��ֻ���O���@f�E�1)m�*��rje��v}�*RِPc�������M+�6˚�g�&�}��ݮ��BD����EڀX���#m�XB������A�!���Y6�b8�fr2�L1��1����M���Y�A���f��ƖFn�M��)�U�k� �LO�4�e��F?�Zy+&E�C�$�]x��7�(k���#B�c\��½|d�*�Y3^������o���g�1�y#a�WU��m1�I�oVGec�HA� ]�s�<�=i�A���f��X�� _��F����x�I��ͣ���o��W��3(l��z�o��&�� s�)5���G�4�l��)�0z�/��\0�-����HhjP����.�=��U���C� Ō���WN�ے[��I�No��7���� i�s� �r��L� \��J]hb� ��syw�߄��E�~�28q 9�u����5ZT�甛��d2��5�$�������@u,��O�u�~Чz���^�\ā �5�.��48R,�A�i7g_�n1�@�P3v���k��@��5�|���1��*�iJX¼hWvQ�٦a��/��TAUॴٌ f�i'n>��������WDޭ?�����뉁��{�Y�@����d2Ӻ�Z����C2 �4�� �5��c>�2��,*c��<?�H�&�]Ȇ��b�C��[���Z�ʫg�N��ć�wm�um�q�-�n���3йE��R��gs���S�Ѳ�;�҅��=D8��x�r���� �}R4sPEdT(�V�l�q��pHi/7)q�*;�R��̾3��Nq%D�ܵ:�y�HQ~m8�0�k+g�s�R�g2�+ã^u���?�-ܧP]���dڙ�imC�O"��i�7��AVE3�*x� ��%�Q{Ej���$����;�j�i�Mއ�s}�M���-xO���V�礽�g�x��9�Kmq9�ahT����M3Ӱ�~I ����w%K5A�`�6.���0I�m�i�[�8�8�W)c�tS&�fɕ�)�IP
Behavioral task
behavioral1
Sample
721b859e9790b886bc06b67d7d1a5702f68e655e850665629f9e0fdb98aa7a3a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
721b859e9790b886bc06b67d7d1a5702f68e655e850665629f9e0fdb98aa7a3a.exe
Resource
win10v2004-20220812-en
General
-
Target
721b859e9790b886bc06b67d7d1a5702f68e655e850665629f9e0fdb98aa7a3a
-
Size
1.4MB
-
MD5
05b639f0262b4489ab6878e6769dd130
-
SHA1
fd85558aa5d566c49c505462c2fbe57d7bf05063
-
SHA256
721b859e9790b886bc06b67d7d1a5702f68e655e850665629f9e0fdb98aa7a3a
-
SHA512
84e1cbda80bd96af82ba979856d42f0a223f0f0d68f4b2de3e57ef45f22b21f55ca87fd0eff828d573b95eac36358e19099ff43c64660065b575f10673535db4
-
SSDEEP
24576:Udv9omOclDvsQbh7HvKYGhV9qvi5Ku9N4tg2s+oCRIPcYgFeOruUJ4uOehYJh:yVjOQvzbpvKYGj9qvisuMe8IHgFeDu
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
721b859e9790b886bc06b67d7d1a5702f68e655e850665629f9e0fdb98aa7a3a.exe windows x86
31bc63b8212abcdc4408184c5997db58
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaPutOwner4
kernel32
HeapAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ