���/�� ԋ?٣EPQ�P���#�L�%��=�ߔ~�_�j����d�ҕЯ�Se������>�\ �Jj���f���娆,kv9t�]��{�G����yzFՆ%/��=�>x���t���& C��2�m�:_��{�����p �[U8�Iަ?��GԐ�3"~��,���^U�� �LD�z�upY(4��Pv�j��`�'��z�������(���+�x��@�r�)�)���J1j�==(� ��˹)>��v��Ě� ��@&+��':r�)�i_��/�kˉ1�*�Ͱ�K�A���Cn��C=0|��>�hT�u�(�M��ז�^�0��b,7d���=����L�=�k��0���p�$��;ǯ �L�)����4Wm���q�;VFRE����+e��z�:W��<ӄ���⫮b4x����9�����ﱗ�02��v�����z�d��0g���l�\?i^�J�-? �"AF��dB���1������]^���="�� �v}!D���.i���u��>'��,���VxfcF�$�R�e�V������H6�bE0-;�I�6a9�oj���0���p����ZV3��<ؐyS�� ���k�4�R4ŠAO���a,� ��jg��pZ���Vm釩ǫF]�z0�������mC�.��N����i�6uy>R֞2��#6���x�1`O�'Ĩ���6Q/�.#���bl4K4!( ��~Ϧ���G��2�I����q����$��y�[��(������_��7�%�����m� )O7�K6�S<�ը[D���ț5�e��&����g��h���� �b�%s9��A���$pl�o��0���o�r5.��h���c2ӕT j�x8"��ze���{(�5)��e���va�O&�y�!5�m}Y��pP~�O,"E�x���:`�a4����b��c8�_�MOƫ���~��2����,� �3(� H�1T���j�)9���L;;��;#���T�:[��A�?���j��m��^ V��:��<�TH�m��7s�O�2��@�Z.��eB�n�m���8h�S��|����5�¯hBP�#�jPL���w�~i�q��>��h�[�Cɨ.!��Y��,2���l- �X��<ݞ�Ə�/�jA��9�LJ�����B���Q���% �$�5�f������*�Z��������4��*�8S^��@ކ%G��+���J`�L��s�;!�d������L�@����Yg�`��`�ʏIKv�pE�f�L7��)�gȂd�R�OČ$��H&��+�m�t�����%���>昇���H( 1sS ;���{j"v{�d~[�$?)�R����<3o�G���V�M2��0j� XT/i�$p����*j�X� ������/*m@��x�s�t �r!�)�a��8��Y�i 5DGW��E���Q!y�B���u���+���S��E�uE�(F�)������d�c���$��D~����y�����D�^0���O��RaD�P� �]���ch��U���%�H�n�wd�h�$ōӽJ�� ��yx�~���Xc�~�4�^w6E���1 �������&��炣��Qt����۶Gd#�Ҡ0�#mV]@�IuI�Ҵ�ل�8�i�hI�bј������@ɛCV�lJ��etF'mrf��"�_�Xɓ���� J��_�u��zAcz����?�� �}�xmi���'���{�su�ގ��GW��P�g(�r�������g5N���X�fP��� �y�x�Ħ��[������P�~�e�6v��)R��)ټx�B�S���x� E�b]'�� ۭ8P��̗!m嘝)'3��/<M7� 7�Gګ�G�Q-1�Y���%x�����v��qÕg�\)�����Ib�IfJ�,��6���K�!j��f�H�'������sݖ�P���so������ ����g��ޡTp�ngѱ��]9���ә������l���B.����G��|��V�G��v�P��7�N:Z�� �ڧ�o��G������@y��:{$z+�2<q.џ�i���۩�e%����E�I?ϹE���?H�����* <��_�Z_N"[ ��.D��U'E�j^Z;���XE��"ŴF"��u%d3aF�'][�U��_I^��xv=�܁�~<�l����{W<�a�E�hN��l��U<�Du�n2?�)n7�~��);G��Ԛr�y+>����ST�2r{`�4��݇�8�I U�LNA�90�X��*���ĺ\w�F��0�$�2��n��ZΪ�'B�8�,S�Jt�n��+�� ��pr������1f(uƶ� Bx�[)eg�<L��b��#����S?Wv=JS�gDb���2W� iZ ߖ���gg ��Ch7�h��|ݙy%[ ��GpD����H4�6"疾O ���,e�(�Q�+��i��t�O�y�m��4��p�N�C����˫D��-�2_�`:Poe��Dpu7�r9�ēA'tL�w1U�r�bg�X��U�ܟ��\\�Lo�6�����!>��^��!P�}~W����B�c#�Ǭ��:@ݪ�.�좭�& �Uׯt�h�� s��9�]��m��J�Mu�%C'�c��fd����Խ���bX�9��l�����t�� ���tt R������FVe�ߊ(A�c�3��eD�s}Z�}_��ov+�q �����;ۉlR��>�5EЇ��q��#��8��0��A-����ռI*�1������������6�a�C�@�w��n�����'��v����J���$~U�B�VH-�v�s��Xo�-wS��hV�:Ъ��}3�fcۉ��u,{��C@�O�2�XMO2�m a�\�J���r�����-�9tԵ���r�(�_-�wq@�W�� �i Q�I�=9�[sU��F��iG"��T*���Q�[lw��q2�XDe��\����F�k=!dߴy���*'�:�yb��)����,�kr�}��B�0Sk����!��2�sc @��w�F��1J�4��j�^!�c =�� ���U5�zX� ;\��&�$
Behavioral task
behavioral1
Sample
4c10a8251a4a1f2adcdbfba97ee29a5801209018be5ad51933eebdce9e5b92c4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4c10a8251a4a1f2adcdbfba97ee29a5801209018be5ad51933eebdce9e5b92c4.exe
Resource
win10v2004-20220812-en
General
-
Target
4c10a8251a4a1f2adcdbfba97ee29a5801209018be5ad51933eebdce9e5b92c4
-
Size
684KB
-
MD5
04eb02c905aaf0a830f82302d4d73e70
-
SHA1
72eb05f48d7e02df96d029d3f0bddbbea93144a9
-
SHA256
4c10a8251a4a1f2adcdbfba97ee29a5801209018be5ad51933eebdce9e5b92c4
-
SHA512
e32edb6e3d38bf3a95744c177fd07f63c06e4fcd459753ad9095f8a4557a8bca50805cb03164cbb4c612719acae140cfaf9f829186282e7e469c9be7382d7ff3
-
SSDEEP
12288:OQqjQorlrI5q5Ji19LQkskj/M02NUSHZyP8UjWmA5Nwl526qnomTOkJdik:O5QrY5+cADM02NUSgP8Ujmnwa6WomHik
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
4c10a8251a4a1f2adcdbfba97ee29a5801209018be5ad51933eebdce9e5b92c4.exe windows x86
93dc0ce6cebcf194088cea64f927f763
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord716
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 412KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 668KB - Virtual size: 667KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE