NcN������œ�i�1�8���U߮[�mU���6w2�شs�I�G�Q�d�S�Dq��[�e�{:�:�-o2Sf����gw��@���m��^,^�t�C���,0��~����$��h��P�/�m����&@q'S�ݹa+�[)h��r���<,Gh��vq!�I��?���ੜ�jU��7�g�5�Mn� ��6q�Y���rEż+��F��j���Q���� ݸ���ꃯ��ȄA��e��~+��tm�6�˝��!��\r 5�8�+vu�6D5d��JBeJ�+I���+��ʹ�J�Ԋu<fZ�l���l�Ί�Aq97��K�Kn��4��u#*Y��� ��)[��.��f)`D`3�!\Wǝ'�S�#��p������!AE��خ�O;�R����4{��+�u��{����r�{�+� �'�� <M�8'�)Cb�+n����Z�:&4�8�u�c(��â�CU8�UϠ���p�������Js��L���52��~hy�sD�G��@��]Rګ���prp�V�i�G3F~�M%�o�]�9̨s������6A@:�M�yIYY���8���U�,��n}LCĸ�^ޢ3.�l�j� ���b�Z �R�D_W��A[j=2������� �o�`��GW�]A�b�f �f�L��@f��Q���E6��\���N�����F������.+p�B4�g PTh��ۜ���&9������.�7tH�C�7�! }�FVG���6���FOϷ��Uh� �ύ�w��Mt��.\N��-\R�[�2F��<V�&�M������C�T��h?uC��J= ���E���d� :�h����.����Ύrf���0�z{?�96_2�ћ;e�?"+�D�J�2�!��6Q���e� �1$��V`���z!��F{�l!�!V�W}����������6KC����� 1� �)P�Ag���ɕSqfp� @Ԃ�?o��x]uc��>i �-�bg�?��-�]��Qv��� w甊��m�~���^&zh�'��� YՐ��_�/�R�o��(�q'�@��d+����d����j��+T��A��WIFs���T��\(���/c tv�,��$9���~#�@�ƳA%�Ol;@�H�L�ex�7�S��d�KƷ���l'��|L*ǡΧ�C�Kp����#�>9�rd;��sb�O��� A +[iv���by�0h~l��ۗ�$O7��X�+ÉP��M}�.�5:���˳�":;iگB_-�0�����2�}\m�Z,k@�t%a�(V)�����:%���"�"��kqm{�~�L��f�B�2�Fk��KV�'�x����8DR���f�NJ'��̷����C7t��w�"���?V}�E�Q�.��My�����xhc_E�l�ǹ�B�13��}d*oH�@�j8��ޝ�:aI%k�Gd7���gY\y�-}:?������B�f:��wv�����z�B٣ N3�N�:3�{��ED(�v�ع�����Ywp�\m���"ʼD�j����N����-����>T��R]j�z�(�`�� ����^�T���ڬY��� Y�y�G�rxu>��N?8�*��Ǎ�^G��WG�>6�D��z�3M��E�= �a��J���kAu�N"ד,�A^y:4xL�ON��9hXge�i�i�F��p���������*�K�.�^V��e�o(��m� aZZ�8��ٝ��J��9aƠĝ�!��Vg C{���YY�rK�I����q�s�Р�֧e�*"�F�6 �=1���/%{�~(��f�~)��k}�;^�< ����Y:&e;-�� �l�1��<m�]�"�-Q0���6o��#c������4-��<��=-CW�| ͥW�!op�u��R�ۈ���vQ�?�)�Zq�w� �8�g�ѕc� W�(�P��3t�[kQ�$�*,?����#�*ZǑ⥹�e�<�~��ʮ$ް�m1���ɮnF��.�Cg�ӄZS�bf��憋�3r� ����=XUƉ=����J��M���~h�C���D�{D�N���vz�X��N�Q��"�ۀ�w����`�O���3���EH+6x�5��($?��G��O��F)f���v,<���i��}�f�l�����br��c�T����<�m��D-����"a�]�v�RY����Ŀ>*��5�|��Z�7R^t�S�l�l���{��us;��i����%1Đ��Π�9�<�/��@���̣�����IO�Kf�;7M��6�}w�!lD��S}hp�]�o^N��\``��_e(��>�ׯB�%�熛C ŎGC>�I� M(b~����<��� �G����o��Iy�Exn��<�L/��� ���ĺ���O��LJ�5�{Ֆ��B�$0�n�z�����"Y���ݎ�e1Z�c��CS��ױw��B�1L|ӠR������m� Ka6�ak��:N�=�ӳ�#^� �x�H%{t��"GZmb�QfX�<���'���|w�N�;V�:4�BO,�� ��]J��i���aŁKb-w��טӯ%ňUG���*�!t�2�+X��S�q����X@��z/� ��j�XJm�������^�N�-�bJU�� Gg4O�=�Q�c��v��*��(+=�0-���"���~4@]$}`����<�T�4â�V��4+3��~n��K��B�I��ۓd�~���} ��:wú���}�|��2�<�����~� ���|�γ2�ij]�瑧[i�eD�n����9�"�6���o�QkN���.#�kCK@R�Mue��C��qpT�p<k��c��٣�?R/�w�!�����ƥ>��:�d#���W�6�_�� F�9�#-�$˙XȚ�������� ���#��C���T���g��f������V�(ͩ���I0�]K~�|ɶ���QWT\�<���ij�����v<S�2�2�*f8֙���@����?�#���X��VT���^����B�z��wԳ�_��Y���>����0X��0��!|�����G#�W�5#'�n[ 0�<��������ó=�� A#���
Behavioral task
behavioral1
Sample
0709d6c1a0b49c051c34e4bb68071b3b8e5ff96f9bae92ac7e5e0194fa9136c1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0709d6c1a0b49c051c34e4bb68071b3b8e5ff96f9bae92ac7e5e0194fa9136c1.exe
Resource
win10v2004-20220901-en
General
-
Target
0709d6c1a0b49c051c34e4bb68071b3b8e5ff96f9bae92ac7e5e0194fa9136c1
-
Size
560KB
-
MD5
096f325dd4ed5214065fdfb00f321e90
-
SHA1
fe95b03a916767555e5bb7aea94539421b3c06c5
-
SHA256
0709d6c1a0b49c051c34e4bb68071b3b8e5ff96f9bae92ac7e5e0194fa9136c1
-
SHA512
c5d025755ece1afbd1f3a8e5802a354ec60da00045c35733cb4e7c0fbb1d35b95c5d58baec0822effd0346ffb3b9285d831c14ca85976ff5456cfced02995a50
-
SSDEEP
12288:Ezu4JzUvIs32j7sQb3kqS8XN2tF20daORW5GCWGcpIKWyR4FPU:mu4J2IsmXsQTkt0N620daIqmpV
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
0709d6c1a0b49c051c34e4bb68071b3b8e5ff96f9bae92ac7e5e0194fa9136c1.exe windows x86
de41ce6207d116854a325efaa4f5a9f3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord300
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 544KB - Virtual size: 543KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE