�y!�����)1;���vuޚ��7 ��d[�>j͉o�����>�oPs$l<�#)�/(M���f�^JҡdП��]e�Q�j��;�x�35K�.�S�g�J��_������ ����]�y�Y�!���ru���\�c�_OѾ�,�wǧ�+<+������@8��h�n�;������n���̷�k+=���M� :�Fq!hRa�d��"í�()�f�T)��c����i��g��lW?�6ȾhX����a��D�W[��^�]"z,9���:�3c�l�.�H����x?�<�Ĭy2e��Yht;�Md닆�v��ϛ�y��H�x��x\F}#wB��`���~�[�;�2C6��%e�0�0rZm"�v���w�T��N4w��B����<�s<�. ߬�������~�A��J�B����s�h��;�\����^��-�a�� �шb>���a�t�z�2-`��� �g��W%x1F��%ϱ�5@d���>�a���J�U�Jҟ��_�_u �cjVWF��z&���][��>?�X��_#77:n�S��ӑq��]�+B���I�P��r[1�E�&�g'� m�a���BUȘF_�zXy�|Fa���7���f��F���:ә7'��I��,�9�Gυ& �:��B�S�@�'�Rz. A��e�|�C���z���|ddH�RA��=N)�"�� ��E���]7>;~Z���Y ?R"S�e"&��AvoLꚻ�6r�ͦ�j&h��/ ~ݰ�^L|��#ʡ�)/Y�lDB�-�t�V�m���.���������B�G2İ����FU��w���4��B�$ߣkF���0����K��`rUK�����u* %���d�� �{_�;`�gn�Sj}#��Q�hBx%���U�O$���r��֏��tF�G�ٜ#wOy�c�fC��+�f���FZN:yt����p�F�#�N�!U�2��]�L��`��f`FWzę�ꛞ"Q ��wU��z��y�+��g�9���p�àgm�O��"��1�d�/E!|2q���.� ��h�-�8���ؔ�x&�GJ��֪*}v���^z�,s�L*�n�zX�ZY��%�D�Y��s��c�X+���?vv����yHT��]Bݎ�n�1�!��F�X��?�0��D�7���f�Pz���4��Z]�)�0�㴵#-�h�?��u�vi3�m�ތ�r�a��!>u��}�貒!pÖ� �-� ?%qcp�lh�Hbv?�e/��7hq����^{��&����_���e5����;�Ët�F�:���t�^�Ş��A/���0���s�Ŧ�C��:^þTl{p�q�;ځ����w���|�ޮcO���}7�4>W!w[�8?U�^�]�1����V�B�%R��O�I�c����e�R2��n�����YL���1���PFHꐇkJy���AR� 4�!��}/T���|����m���E'����c�{e@qO���Co��E��Sqj���y�G�O�Ќd�n[e �+8{ȸ(4���O�_��[���ų�k�c2�����0p��/�Q��oC9�B7�����?���[0Z�?�Q��O�"}�_E������:�P��Ⱥ}D�B��,!�U��+d���y:)ߵ0�M�Uǵ�/�ŭWPQuY��]{��X�ډ.R�l��Џ�����A��7Y��=���_~ă�*,w2��Y�y:��/���l��@�� ��_Yd)���T�DFm� :pDŽD5p/-[�����}�S�˖�Gk��.3����D�Z��T�)~z��c*]�t��X��r�$aaUd$[�G�%�/c����|N�{�S�(�x����y����/�~'����r�u-�y\6��/Y�=r�j٢��Wu�/�&{=�j�y����dV��R����M�ar;����8ͬ�+^A�ר��,���4��!�y�O����!a+�Al����1�*�䁰��&��-�w=L(Y��Y�ύ�x�i�f��2�^� [:������� ?욐[�mGU4^p�{ ���Eq��oi�E���8�i�����b�i�e;�]� �V*���%�|��sS,hѤۼ&�5� �y&Fi�F�ԃRl�?����A��?��ra��:y@�,��k�gF�O��C���qK��&�)@��}0d]]@�����t�ڞ����=���<��̦D\M�h��jk�a�B�)��U�>�Y�<�����QtQ�N?�6�}��N�{&����tcƼ �2zq�b���!�c����5�f���7x�iw� G��.7��l��}�"�moҔo�-��8����X��oQ�������܇�yΞ����yR��j��s2��Έa��qέ}y��ѝB���{�����~/�|��hD��Zth\�-N>2Fޟ@ޕF��9�T��vicXR��˂�%���n�օ%oae "i|~�rAZ�cq1�1C�0�� n/~7�!�Gv��AdȘ�����E��Mf����*�v�%�!_�����G�7�� �0}ϑ�@J$KOb����Z"����!� >Q�M8�MCe't����ί\����C}�+�����:�K���c-+�� y�W*t�:�/s�qUW/��%�?�zg:�Ap{T�^�PE/�yM��X�Ϫ~�4.�4�����F�8�|��ɮ:��� &�+���G��&a����� t�k�b�=��@�/�j��$8����4��S��.���NU�Ԭ.�7M�����w_=$���do�H��8�+'�i�h����T~�6 ۔��[����#���Ƌ�**��(��\��a�b g��pפ�=��\���K^�n`/E���<�� 's���"GH~[c�4T����G�wy�g���,�"��*��j�>< P.`���]̺NhmG`'���,�Ks�e��VK��Uam�����F~ms�I��C������T�����tm�����f�3��w銢ƹ7ŋ_d��mxq��˸C��c3��̕i6*PI��#�ŏ�d��[��Ӿn٫u_����n��n���8|�b�����&~éD_e1�qh�MF_u���ά�S�Yڊ����E
Behavioral task
behavioral1
Sample
dae22c5adbc861c0b4bc3023f8d0e9e70f3e2c0ec39074737e7de935c1d0eb90.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dae22c5adbc861c0b4bc3023f8d0e9e70f3e2c0ec39074737e7de935c1d0eb90.exe
Resource
win10v2004-20220812-en
General
-
Target
dae22c5adbc861c0b4bc3023f8d0e9e70f3e2c0ec39074737e7de935c1d0eb90
-
Size
556KB
-
MD5
0e5519041cd5d1c8915b43f95ae343e0
-
SHA1
8cd8940fc5f1edeebe80d088672364b0d187c738
-
SHA256
dae22c5adbc861c0b4bc3023f8d0e9e70f3e2c0ec39074737e7de935c1d0eb90
-
SHA512
9230262b83f135291b03e361ce4841f2b4be5362beafa52d7936d835a3497cc9d13bd37943dee3c919ea258977ad5cca2cd20bdcaf59c391921392887a8fa476
-
SSDEEP
12288:sjqfVlnARMbXZfQ3IsWqVCjxCVXb5uQB8CZ7y:sjcVJARMbXcIso6r5uQz7y
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
dae22c5adbc861c0b4bc3023f8d0e9e70f3e2c0ec39074737e7de935c1d0eb90.exe windows x86
3922ef0edfeffafb85a042db5d6e4b84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ProcCallEngine
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 540KB - Virtual size: 536KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE