&i�9R��M�E>w�G=Ar՝� ~#:"A��ݓ{� �#a��Π ��(���O-뼝ۛ��i����9��y��1�u�L��Pydbۢ:����f��(��|'��X��Ia.�>n����t��Hص�C���:�msol���"���B��v�;ؠ�[��neHE���H���&��4�&gr�ޖ�3����t���J�'552��2��;���IAz��wYw�l�ȍ��������Z�:ŵt�bd?�u%�Q�B�p -�!֚db���3��d,6lx��X��S���hs=�?�Dd8�Y��ؓ=ұ�'�!�8�-��П�z��L���z� �U��W��5h � ���@�> ��vb�p�ܱ��B%����q�BC"?��3R`�'~� �J��$�I}�vw���V��K��#Q���L�|e�47b�no<u���L[���~��eFu��QzV$Q�����]�8n� �����.>O�U�I}�7n1�Ɠ�o��E���Ə\�~�w\�A~f?���%�2��Y�����fx�i��Zj����ys3�ͻ�HmM�O�Hfl�{�pK�ԿI��c�$L�M[o������lj�/��g�#�Aɦ���X%��>�|Ҩ���$R�����^D� �Y�ٹ����4�+�ݱ�.�U�� �}�Uh�0Y�q�X#���@^���%=A ݩ���_G%[��Z��GS�6�R�E=űo�?��6d�Kj�l8*���h�6]/�N����)���y���{���i%IIu�Tf#��9-�&3�zl~�lϟ��,�av��N�1�!a\6�Qw��vK�� ��a�%��:����xb{ ������{�қ��.�mF�^�> ����Ȝ��8���$Q\cq�9�U{��n��_;�d�}��H*��M�k� mSPee�EGe2��U߬j�Bִ)���]7��s5x2I|}Rd;��&��`L�h��B'�<��2�=��fn Sp��U<����������r���3cy(mp��8���;%�I4n&�����!L��� b�|R�@=��W�j�AB�}E�����Sb��I@-M��q���EDg���c�V#��F����Y��2�t�V�A:� ��� '!)ל?ǫyF��Qb��$��zP8=Χ3�_U�7"o��W�S1Ӂ�2��ja�/�5g����EY+]�UF&������V�NA5�DM��"�@s3���x�����i.���_^H��Q�Ƌ�k��m#�>��R\*�G_�K�z)��WJ�!��e ��y|H���lC�"���sjvI�T�]������1l;q�8�W>+�����ؗ��}�c�.~:���h�/|�J6����7�$���E����I�=;�����e��W�����)��ͨ�ۨ��[���o�5(g��$���v�+��D�FK �2#��Ԇu���!j:�~;G Gcf�Z�E����җ͘:_I��vex����u��8;�}���QV%����ڭ�&_X,r�{c�W쓀�ՙt��P��T���C�1���@�\OR��k�wگ�B�U��yU83��o��Y��b��6����Чo�?�E�]�P��e��Q*W6T��ũ�k�j\(�%\�������֠�V�pҙ=Y1�ݺ���E����VN=J�uQw8�+I3,�;dֈ���ji��e6#����o|�^�ĵO��|.^�Zyb�����B/�E\� B�(�k �CӂK���&�!˧�<4�������|�X϶G����6���"N��� ���q��G��\>��܈أϖ�Ҳ���"2����ϴ_'��pR����������(H��&(�2�7j�d�C#.�rN0�6]�Y,Ѽ��0�7w8����C���<_�����3�0r��5����k�?�� l���nCvo8��+��Z��4OUC��Z��f�<���ѳ/^OVz?�s�I�(�����:��Rj��ۓ)�2�&�)��t�A���B�a��R#�vǦ/�!�L�T���M �|wT���쿋t�V�Y�m��c)��EaΓ�&KzU���!�e1��U2hphPֻ � Ƭ:yN�BE��B�S��X;��|���;wے|���d&���H�� \,N�\�V�@la-bnG�;^@!Ub�l�tp�rk��k�Cz��r�t�ޱX<��ߛn���b��x܌�����4��V��s��VJ������ԃ@��~ ��U�9��?86?S^�^��b�H� �-}�D�������_��j��ה�ll�!�{i]�B�l�z�^�ڞ�;�ȉo�HjpZY��ꎖ�9Hl+���Y�s�R�� �H�ѱ|YD�=Wf,�a5m�ז5�ME�i�P#��?tm��o�@�W18l�]���h���]3�`�T���c@<���� ���0���)A;��zNZ����yU� 2֒cu��!p�'@�� |]3-��?4�β�M+�!*��e�Þ�Jt��/{�X6<�x�����;v;D�d��' ��1 n�Г����H��� ����f5Ӯ[��p�.�8��r�ֳ��"�����Jp�R�$��X�.�4~�9��)���R�!ԫE�/1tB�j�6h��gM;�������>o�3�[��v�<#��$��Ia� ]ť�%�Q�����7�G~3�X�1���7�vL���G��9!��@V[8(�հ�(A������r^��\5��p��[�������� �u��߈qTcP��O�j&�+h��Wi�+�sD5R��邦\K�\��`��������TdG�>3�V�W.����z�T�CKZ��үxF���.m�~(�� �Q�I��tf2�;����yضގx!@L]9��f���z�T��~��P��8ׂ��誵�����S�����jV�5���{�N���o�P�I\��P�1N,�=�G{,�,]7�$�Zk��!"=̼l�L�C-����d�T�����"hO�����'��4�A�it��Aac27����O���)'�E��`ᡂ�z�Bc���u��ί]n��]�y��嫷^Dn�x�Gݕ���3����E�]��L�
Behavioral task
behavioral1
Sample
e1d3f61538787e89ff8868451b4595d4cc26c299e55eb38690a3a985a02e64b5.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e1d3f61538787e89ff8868451b4595d4cc26c299e55eb38690a3a985a02e64b5.exe
Resource
win10v2004-20220812-en
General
-
Target
e1d3f61538787e89ff8868451b4595d4cc26c299e55eb38690a3a985a02e64b5
-
Size
556KB
-
MD5
0ecae95fdd9f35c791f345ffabd19e40
-
SHA1
968719a846ebd60863e3b49c3a2aa92c6442d18d
-
SHA256
e1d3f61538787e89ff8868451b4595d4cc26c299e55eb38690a3a985a02e64b5
-
SHA512
b448af2c0950a59218ac6f76c5d6c6097aa52cd3af323e0500654ad7a27e9e66eb83815fa3b9701cd343ac6aa9d31d7ab6ae9fe74b4b76966c21b044c29e8a0c
-
SSDEEP
12288:b/NR8QZ/qLVQCdigI1LRfcmXwoG2LdUA11:b1QQdgcLRf1woG2L9
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
e1d3f61538787e89ff8868451b4595d4cc26c299e55eb38690a3a985a02e64b5.exe windows x86
5918a9e8884b77c976c65811bbfe40c7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord613
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 540KB - Virtual size: 539KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE