��"������8s��Y���?DV)5X�mK��f��z�%� WwӓY�1��+Ί���4ѓ��m���G��3ou|[�"��K���f��>z�5}+�!]��ժ��EQ���s�i=4��Nˏ�0DY�G̤��Jzk1�Nʓ{r�?��a_ߜ^�g%���w��{� <V�~�YO����(�{ T����H��Q:x��$3g(Z�Y�<���V�z�8��EEE)�FY�(�W� %�l����Vh�u ��B�օ�l�����c��($���^���sY�h�%���� �X�.����衹\�r5��I�z�w��\�Q��Ff�Jl����o�5E>* �O.�O<P�)��9�: �H=ЏN3�?B-ȋP�Y�'��~<�����lּ7{�s��S�K�����{�z�+A���.����{�q�{v��p���о'0�dq=��8�t�tK��+c�_nǂ������w4��ӵ֮���EL�����~���S�Å��}'٨��� �܈s)���e� ib4G��7D�(�J��������I�PG�,��9�y�Y{+�׳�)��jlds�G����x���J��h����`�;w���ߕ�@W���+6;�5�K���G���x�}��G���>�:�%Y�y��G��&�P:L�PҝdAm��\���V�0�X�,eE�zw0i�?ܨKN8�qZ�#��#�f��B�{�<�z�\;Z!6�ᄇ��|��G:}��8FF��<���xwus���Uv H�� �E�{�>@��a'-�������h�)�\���Z�@����&E�`Er.��WB�`�v��{�L�_b�Q�e������F-��ʳ�P^���c^��۟����b�oUs8�6����:z]�3�@�(�Y'����=��_���,����5g�U߮��x�~iXm�yw�-���2e�"�O����At��X�@�~��ȍ��>x��w֯��9�=���!�仠�C�l ,���Z� ��W�ԍ�p���-ou�E����-�'3�� ֕��w�������,,�B'�)�0���wە;�$����Zd������A���J��]�OA�7��OS��4� IJə F��M��]:v�-y^��C�6n?3����c��9�V��0�j�n�<��z����+ [kϣp3����!K��K��|�9��ѥ#�3d�S�!��Z>S!�]��eV=�;��%KG���7����T�`LVZ?Q�[r���Z[�9 ʆ����Z��������j@�}�� C� �9� Y9�4s�2�i��.��oX�m��gfz,Y�*!Z(,��������۠��+��#��v���u�nҕ��[p���UE�D۴S4,t�#���h@�@ ����)���|�?��rp�?a������\7/'k��CU�:Ő�l�N�!���29R�:Ĝ<�`i� �G4)1�"�&��������ء]��C�����3�i�t�p�@�� ��нb��ߜw E��5��;_�6M��1*-dG^�f���oqDj [����݄o\T�r�;k� �ȚJ�kS�Sz����wi�P[���k���t}0c����Y,�#��.�%�}xac�;{y���]2�R�&r�����8?�w�d���d�Ķ>}K�. o}S�M�8d�Uݨ�L>����#��?�5���RV�\Dk�`���ͺ�>4*�(&��[$��^���q��:EHy��n����[g/b'|.2 m6�d�\+��Z$>J P��1��������Dboӱ#{9�w΅������f�D�(b�!q���$WJ��C�Wo�<���wj*"��K���C�uj��'�n���(��<̚P�2zV�|����W(�7��e����f�� ��ȚM�#���v����H5�_I��c��f�2E��,}���d��P�$�M�.��[���w�� �B�����K�@��2=7�������<����x�E�=LӁwӰ� [���ی�/9�O��������1�1^Y��%�� ����h��Vc�h�w7�B�/����&%��Z�fq mܛ)�#����}JKe�m:T��d8��5ʅ2����B�=+�y��4���2@M�~��>�"��f�FO����1�1Z�������N����V|GN���N;)��D���+A��9�Q�݊�k���4���\_GH_�\ �*l8[7Lh�^��`��B]�J���4'��eŒJPcm���笗T��c���d����Jמ�~� ZQ��c_�E��%���;L�c\p��[9��ɹa��-�:<����5X�}��b�b��W�E;�� 8M�&>Ƒ���T��WZi���Š�����H(HT `��v�Nj��'�"٠3��?8b�E��[4W�^��T��B����c�KrKCv�Ǝ�0��,7���܊�g�7��N!�wCƢ��»'-t��-�~#x��R\m ̺�d}g���f��z�D�WH�(�A+o>Oc�ೈ2����bG/a���\�ڼ�b�/�㿻|��7<� E���zDmv����b�6$j�����DP'v(<�S� C����W��Nm��Dj�R&��T���N�R?�A �%�I���#������6g��k�Mm�F�+_T��r*I��F���7���z�<�a �H��%s�QkSܬ���Wp�E�w꽛�����#ybp�}�}�GV�B�e���s�>1<���n��W' �#JZ|h�*�^�������qH~�M�g����C�mO�����@A?Si��L�1�X��V0�ٺ?�!Ա^�eAx�H���&T7Q��}��� cM=����7V���o�7�Q�,��9i�n�w���#�lj�����R�&4v�U����[iX2����sA2x�@��r\ �)���&o�*(��П$�a��W�ɛ�ҖP�Q* �o^�|�T�(? E��B����G�5���Y���7_�F����?���B��Y1^�'���Q��� � 9;�v#���+:(h���B:T�M�tއ�JwQWC�#0��yP��U�b�����]
Behavioral task
behavioral1
Sample
555c95ec3011ab5bddc8cf7893aeb92bb35ed2c19e98a3481c4c8eb39e6b9e8c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
555c95ec3011ab5bddc8cf7893aeb92bb35ed2c19e98a3481c4c8eb39e6b9e8c.exe
Resource
win10v2004-20220812-en
General
-
Target
555c95ec3011ab5bddc8cf7893aeb92bb35ed2c19e98a3481c4c8eb39e6b9e8c
-
Size
624KB
-
MD5
0e476e12f2c919abe5d821100067b720
-
SHA1
70505532d6ab1e0b587a5479179a9df61d8bbe00
-
SHA256
555c95ec3011ab5bddc8cf7893aeb92bb35ed2c19e98a3481c4c8eb39e6b9e8c
-
SHA512
9d3684a82aad1a7d824ddbfe646155795fe1f428241e3b666704af6e56a836308466f3c0c92bd3ec44ebfea380ec1edf0dfd11dea60d0594210c1ddfe62d21cc
-
SSDEEP
12288:fcaqiZ87oR1UjMcGM+5Xud8//QJpiuSKEHqzKdiXulX9sOYIsjU+V3:kaFZ+ocMbMgXu+//ju/FzKdi+NCDn
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
555c95ec3011ab5bddc8cf7893aeb92bb35ed2c19e98a3481c4c8eb39e6b9e8c.exe windows x86
c3e6d5151d815c14450184ccde8d45f8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord583
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 608KB - Virtual size: 604KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE