C ���ֶ A�^-עS�>��S���.n��~�������rI��j��ű[����q����,������m��~�}�Q,����^�4���Wy��gQ�HbE=�K��&��d5bR�R!<��!)#���a�,���q+���GA��BS�/f��8mo7�]���o9z��@�@�{��_���LS� A��~��u]$q��4�Ƚ�6W�C�Q��{>�b��m�4��o����*M�j�ƒē��R�G��%v��i����<��������w���Ez�����d�����o��P4r��;�Kmӊf����93ٸpV'�4��,��y��ɹ.�k�f�{�SYQ���N��T�����;�ι��rT3IT�۞�u�Zr\� C*!�j���w��_�#C�2��u��d"0��Ժ��J��c=�6EI�4Z��"N Z���(��+ ��,���%�n?���˴A���8�6��jf���'�>�j���tV�����IS*����.���Ņ�� ���h�?���� U�~�"���0��U�1���z��DV�=}�m��dp:��v�� `������ӻ�,_�ֿf��wp�|�P�9yq��p�3�W����90��]�꾮N�h�����T����ge`^����MΙsY�'���c��p�xaqB�Q���-V/Y.Y�ܕ��T��[Y���u㎅rpܲ�=ȵ|S��/�#r��Dvp���BF�)�+#�� )�NxdTqaCi���;�q�Y6��TrK~I�>�m �PC�d^Ξ�]��>Od�i�?�hZv�_�9��ح\���S��{���;��_8�&ֿ�OE�1|�7��'D`j+D?dyǑ �a�>u�놣�fJF�����a�`�~�j �bZU����Mh��ކo �tr�%��N{Xl,�Ȅ�H�-Y�4\X�H��/σb{zC `��� |^?�ĥqV�i�D�#��s��$���晲s5"������;�֘�� ވ�*�U+�I@F�-ɏ�d2�`� )y�J�,oDž�ύ�ޭ�I�������ZA�ߺ:F�2��]�?��U�LD+��ƝBR�U̮��C�;7OK��(}�&ɮ X�I�*�M���!q�e�+R)��Ջg���P���r:�Q�ʻ�9'�X,�A��R�pi5�[rx,�ܒ&���(�/�?���l��ү���������Pl{���J9��Χ�v��k���x������1;�)cs�=!��b�l�`4.T"��H*�w��,� 6��� �z_��D��~���!ͦG 9�!��q?:����N���;�O�Q ���|UhN���c��5�AV�xBPsus���<r���n\�X�S@�e"��GԠ�?�W�҄�>��?rL�� �!�#�7)Z0ױ�!F���|F��[k"_��v��yJ���!��e�������ߒ�[��ij�<,<� 4�)�ɧݔ=��9]��z �;�m+��|o#� �[�|�`������ �(�ܒ�{��$D47�S�!�S"s�,(5�NG�%F�FF�ۼU(HfofDr�fȩ?�#% z�_RL�$EͩH> �x�uv�ڋ�뮵~���mr�I�ne�J��4�}�5�7G������W����N���#2&�a��Lt�2���NQ\�����Pí����w������?��i�\�'@q�|L�پ�S�Ѫ�ޞ��-���&x+� �����5,���R������\�ZN.��XӚGt������������2�������9܂t\ā�(����֠�>D/�3&�9���{����q���^�%x� ���Bɐe�^ʊ��;��bh�� i�É&� �� }0��\��dlpU��2��*8.����Q鈺'��o���^��G��{nw�����^�;{�q��/�^wL�)X�Q�Aw����(�,l7��L[�D�i��`�X�1��'*�=N��,Ch�H�j70y��d#���-x�@ΰ!�losl���[��Q� Pv�n�2QP��&�[�<UB����e39��_��o�C�8���ȑq���=3��+7mP.X���v9����]��M��l�RJ�Ic1�\�������r�Vs��|$����\ퟵ�S���㠃�&��9X�3�OM5Y�#�0m^7Ez�!Td@��+�kcȒ��\����X�Ѩ���Jm�!�wW�O�h����ZWSF�"�]E�W���h��m�1{0���&&� ���*J*(��1�:�룢��W������N�v*�����dX#���O��ظ"��N��.��hv0e���o�8+�9��ādP�9դ t����n��X;�M�%��o��E}k�������'�s[d4�{]۪���40������Uj��uH���t(�:����\ȍNR�1y��AY���n< E��_WX?���>��P��jv���hs���̀��Q���D�X�]�cBS��3��U�<�}&�^�,��Ond\.DT^�'�=Ñ@��Z2����-Z�s�߽*ψz����wa�����e�⡷�cd�T=�������K��͵^���)�0'�#%Pa�'��X��?M�"F7C6V�Ǐ�6��{[t5�[���A4�[��Xw;��_�깭�O��>�J,+T�q'�����:���o����@�|�j��cg��ci��Th��GL�E�<��<���#���b�*��j�� �~PdD4�o )�L��֒ۯ�զӑ��O�h�]"��ՙ��$�!��͟�#�j��j`������6�t����\�^X�v������ڨ�����[gl��R�㊓��`��ǥ7&���Vz�b��\�۰v�/��c|� #B�̏>D�:�s�w�����2*���5����{ЕK����ݲ�r �j�V��y]���w;���w���G�)�{B�n�Z����438�K��_~ⲟ:($ѐN���ɻ��j-�������fnr=��e�yxߟ �Գ.�6��@N����l�G>Ȯ�y}�E$1"$�E���D�������/��O(��`_Z�,48�]�gA��w��]�D��f�5��!��|�u������l�RB�L�
Behavioral task
behavioral1
Sample
29186b48d49c4285284fadb9ddbab7a372c9ef44b2e59c5b75666fef76bba182.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
29186b48d49c4285284fadb9ddbab7a372c9ef44b2e59c5b75666fef76bba182.exe
Resource
win10v2004-20220812-en
General
-
Target
29186b48d49c4285284fadb9ddbab7a372c9ef44b2e59c5b75666fef76bba182
-
Size
532KB
-
MD5
0f668d8882249dd59f7c5a030acb58f0
-
SHA1
a641636de0b0eaddd9e4e39fa01c525a16ab90cd
-
SHA256
29186b48d49c4285284fadb9ddbab7a372c9ef44b2e59c5b75666fef76bba182
-
SHA512
18f89a3bc27804abdeb4bf86531d0a4927eb4172b6073b58e2d7e692adee94397333fb2e4d7352e4037b8cb4c00beb04c58509fa7d06cf02e277962fcac4f2b2
-
SSDEEP
12288:jRTsbWVxznQEVx5qRcr25EfiXx+81P5ZiyC/aBYmI:hsiTDQEHvKeeh5ZCKI
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
29186b48d49c4285284fadb9ddbab7a372c9ef44b2e59c5b75666fef76bba182.exe windows x86
4207344a08e4677248e3ed26fcc9a35c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord301
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 306KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 516KB - Virtual size: 515KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE