�}���zW�}O��C.o�m�~���٩���Ӗ�K�!�����u�qKZa�uaLZ(�����O���Y1��)~��� �'JS,���yHa��4ֱ!U�r����6�y�h�TݯA�eI`ӘZ#)T����*�<x�v ��(��� �#�HL�� �]�7�4�������j�.U��KԨ&K��{@MU<4�G�H�g�Gc+��������K���D�84�8 h���˒��P�8�y������2oN�FڦQP�0q�[F{�������bƐ���$��.� X�sQ�G�`���Bv�\յ��"mT���6�~WP�6��C2��� !�F�np�%A����MP��b ��L��ǧ�A��eo��u�L�Y~�h�R�c�Hj�F�4�$��R��[ѷ��5�7s�Z��+E+�M�iK!� P0BXwzSޤ7��f�D���>Y��q(Q�W�����A5.�ga�?�p�=�e�t0L��=4�jE �l"/5�µ��|v�1S���p�j�O�����+��S����Ƴ䫠)�T8�K�e�ZLn�fq3B$��K-�Pٖ_����a�y2���f�3е#����q�D��DYg������1�[V�I��x����{��/~���:;Fw��" ���3�^~�O������0"? �� Adײ���̸�A� i����aXu����jJ���|������%{_��Y�A��%�{�����6:�I��3������;��n��wa�]7@8��A�4�h�1�➑p������-X�����%^ohK.iB??����4M��!Z�i*�:&G��F�~�V�t���Z���a���_�5L��d��Z�q"����|����|��ʛ̣�E�}G�h�e|��3�t���p�@8K�J�C�C�2>���1�`�\�#e�B��-b��ty8��>"#�{�v��^���-5���$3�CUw'#`6��OAxto��%��d����Jgߒ��{�փ`�G�_���R_x��a:�dM˺[�p0˫��� T��~���N�oy�5�e�����7z�ʲ$��H ��������zbUV������no'��$��Dyx�4b^�`c簐��흢�yh*E�������=\MK�'FP�}��X�7sǰ"&�R�f���"�)���ǏÅ�iGI��*�K�ЇP��F��\kRQv����1&&���� ^2�5��H�l뾱��Ɨ�j�t�e���l��;"L��AI68-]+�����^�{&b�="ȭ�t��䁔5�z�w( �Vs ��z�M;o��C��G@�p�!�\o����G� 8�e��%Ҡi m}�W3BE��B$4�#a���ڜd��/�P5!i�w������G��u(7 [R��$�h�m�B�z<*r����6=�������k��B?��H?��MC�%�A���FXx1�����5���R�������%~��t� g����]HIVΤ�� �)���2奓�%��ҹJ���P`A!JLB�j=�R�GJD���L6�}���Ig���))t̵$�X�t >�h�L�5�U�C���pz�q������Y�vi���e��gsL���D���-�݇�˛�n|���yuK��Ei��;I�N���d�G��ێ��#�nb���igq:TYJ�ڴ�h���>~ G�OV�UIJ%��~�~J��~B�b�t{���V�6_��}�& ��p6>���4��a�;��IA-�A%;Դ�$��n���EO#J�:ߊ�R)�y��A����5����3p���(FW�^J�g3Q�����^��ۿ�-��,Dn�$Y������nܻ�צf�џ�#�/=upf�6z���Z������լ�kf��p�s }�^��tBP�-j��%g`5mW-w�/�"�=�m"䅅��=�C�'��4�넺A�Q�ue�����\ ֭B��Nj��^*ӈb��B�h��w���Jk�MָD�2��ؑn�~N>���>�g����p����Y-��k�N|2%;@7�i�\���Bۑl^�ſ�}� [���i�A_ ���z'bj)��Xpe�I�/�+"S�@y����x��;�����fc�9�E�Au^M��2N�Հ��)�X1D�n�Jz�[��s�aѝv�~��?�g1�L{��|E7�|O�fz��g��n�'ط`�DD�4�a>5���ѣ�b���G��[���"���I�'��/?�`���t���Ƈ �*c�%9�_ڑ�����3�T����xj�uaN)���s6�cA�OO���:��q�X�W0��t�kO].�#��oYr��Ѿ�5L�{������q��K�����EV��<`c�g��d�|)m��w�����g�'^�?;J���ʶ �s�ݛ@T�~ �V���jt��t�o��>����M�]q/����_Q��g������,�F<⊶�mr��h�/}CB�D)�&k�\a݂cP��WYo�`F1��{ `��b���� M4K(ێ�C$����"|�piN�V�#�!�"E+Vw�u�NχD��!g�d���k��g���~��$�fxJ4��c<��?N�.6����=m����:w^�Y���5.��H�P +��cF����h�t �tŦ�{��aG!��-wui�l��,�(��_�Z�5��Bt�6�X|��s0���Ary�C�%8��خpУ!�(f�I���Hd�tS��ͅ���~[r�n�'�EzPȡU@��YC�O����յ���4��Fs^Z��}6��4`6H�����B��zu��q�ڸ�'nL��#�Ke���2ic��s��H����S �����wM����<�Qs� ��9.��\�YxԻ�B[�v<����<���/̢��6�7�5��n,���a����a���@6�_-\p��i����B�\��E�\�Rtg�K�<ĩ#�ل�`k���`q�h,;q�Y3��h�>��U�{��^�vf��Oy%�U����5c鼈�8o��S��`����r�:�f~Pwrdy���Qy�����?<B��4u5�0,���,t����F�"4 ����f��In
Behavioral task
behavioral1
Sample
93f6125cb667bece5eb14511b8476c5d6827f83186476b0c3f29e413c8d1ea31.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
93f6125cb667bece5eb14511b8476c5d6827f83186476b0c3f29e413c8d1ea31.exe
Resource
win10v2004-20220812-en
General
-
Target
93f6125cb667bece5eb14511b8476c5d6827f83186476b0c3f29e413c8d1ea31
-
Size
976KB
-
MD5
320a37030651df43e06111fcd1df4030
-
SHA1
06ba0f38d5290c66ea4e251ea57ed541196e7faa
-
SHA256
93f6125cb667bece5eb14511b8476c5d6827f83186476b0c3f29e413c8d1ea31
-
SHA512
ebe4d0c68dac696c15751eb3e725064aecf2b2d211b156ee3d67eb0b5fa1252e96fc4178825ca9992e73c09afa818de1cef1e26f84c1f0621432445032f58fe6
-
SSDEEP
24576:gl9ZnoxWqZc+o+BS26ODlN8UMs3dhkFEM5kk8P9kUB6zuDp6oEcNDM:glgWqZc+o29IU7Qx8Bozqt
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
93f6125cb667bece5eb14511b8476c5d6827f83186476b0c3f29e413c8d1ea31.exe windows x86
7b64b7cd48f4f40229cc59c00babe127
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarAnd
kernel32
FreeEnvironmentStringsA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 756KB - Virtual size: 754KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 112KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ