L�&V`�~!g�ɿ:��D�Y��*Y�)�]`�81�z���l#�1���2j�}�rKDU~��]�$ ������5� �������3?�-��Y�>���ۚ݀'�`ˌd���B�F^�JB��Wf�X���㐐G���Z���DH��.�&9��"��l�^��Bx��y=�lW��p��;<)V�#��Η����� ��p�S�*^D� ���&k]�%��2�b(Ex�L�TU$f;����Ǘc��^["R �x/,A��(��能��@šW�c�49Q�KT�C�#���|6��Od`w���" �pM4����D�)���R,'V7?,� 5n�SM�����w�jUު��<h8h�г��O���{��Wk��쿃��n�A�d���J��P��o53C���:�^o��������F��s�)ݓM��c��z�A�g@���b��C�g"�������+����'�/�ld�i�I���y������R.+t����;P�:��@6�#(��`�B����b1G��XW/V]L4h�����ׯ[J7��9�!zt�ʹ�W�>�y=8�F�Ս9A݅r6\0m��-���I12JP�(l��#ŧ�!�2p0jX�9��j&<A�)̴Y��rL�xd������,�Y|^�wX(ܯֺ��L���*�x��O����24��*C��NJ}&�)�P�kM��S ���'N��F!�J�y��DG �m�m�8 CJ$8��7f�} 0*�z�R|Z��{f��$��d�Ĭ�ar�����`���'�)Lv���dh�.�|���)hHҎ{���es ї�}+&̳sL�R��л4Yy|����L�/Mm�Ϥ���'��Eק�I��5����h���S}���L�)҆/���gG����q[�{]�\�3�n�$}?佸K����d���B�������!�ոr��~�e�$��_1��\_H��j#r�������Z��h�[���C����iZ��� ��A���n�����o���.1��;J`�&7�.Q �Դ�ҁip?��.�y6��aL䫇��� M�q^Ɵ��i�L�����c�Z��vܠh�2Y��o��^��6�:�>*C�<\h��r�a�f��O��eY�����\� 7�S ����� o�q��x] ��q�N���6��<���Ơ���.�Ljp��7֤&�%��=PZ6��hw:d�v�al���#~����.��9��~Ӽh&]F��T�ѽ��UvORP�7u�h{Ƣ=�7 M�A�7\K捛49σ�'���-S���Nۮ~V��_i�4~n����;�D�y\�����(�ip>}���|9��ϰ���Z��|��M8R�����DMU>��ˠ����0�67�g.��*�2��B~�<U���uz�x����V��0�3ɬ��B���hȚ1���.c,�UV�>�$E��)�lJ�3U��:�8 Җ�G<�oG��^��n� ��@!K�!rmQ�E5F�R�+!>�������̒����w�N«��,+k�\����B�MDG��a��'I�C5mQ8On�������b��E�Q;& ��_����5)�)�l�|3�37�k�?2��%���6c����O,��s�Ѝ|���bɄ���%����f���؋��u!�ND�������L������yg�9rNg�`t�>�Ɓ����I��F�n��u~9i�R9}Z�My�gM����%|U2�j�����`V�����б.9#ym�ԡ�����pΔr{SU�ΐ�-���,,4J�1* )~�h�fmA���\�4(m����I�t���OEeiQ/��/'o`����N��1E #� �c�M r�Q��}��ƺ�xi�D�ѯ<�<�h�omDrP���5�� �8(�F�f�|F��<\��m~�{�$g<�Q5��}�]��V(;�)��A��E!iYZ�ݵ��I['`h-z�����Ͳ�u`���'���1<�D�h�c6e9�P9����Z�[n?(D?M�ơ0oH�#16�30�,S�Vɮ��,L;2��U�$�>~������pzld�߮�#?;�E۾�^�M���v��U%9�i��i_0�i�~"jB�=Wa��l9���6��c(���<�z�&�q+2L4�Zbˍ�m=�Պ3N���� ���W��LWJ�Wgζj�!�p���^@��w`�0�����O<P����IH���4�2�J�b�{�f�����$S^��D�l<���`�����x�ƻ{;������>&B�R#�9�U��"��#gp��a/"��-��NH�s�|c���Lu�U��G�^B�OX��0� cО!l�!2�za����GeZʾ�g�a~?å�vp�u��S�Nѩ��fYW�DӴ��c��JKO�ֿo(�'�'�����r^y�ֳ�fI6�LyU���@L�{���G��57��Et��c���(�8�{��ޖ ̠as7 o�Wᛪ��3L�rbj���w�PL.�mJ��xᯂ�vs> }�\��q|��)F�!���\�-�:��m���ë1:�6�!��:��h�c#�B}bm�lɪ)��A�C���e��@8OY�X�o,e3�d:O�i���"���;���B�%:H��ɝz��x��a������Ɣ*^���4_�j�e��6�-�7�&�!ۗX����z�U�Y���)������ �6Gi������fp֓��_E�����`��@��!����P-�G�8��υ�6'�߿O�����\0 �U*4��U��ʫ��X}�� �s�(Ym��m��.�e��d����bA�W5�Ȼ��H��[�ZtԵ���1�D�����;5����`D�=`���2��P���%��cRB�b���я���,�`���DO�� ���d�F0��o�Mez>�;|�VU���}��bF��ead�,���V�!��~����/���K�BI�0���c+� `=�f�5c�\�s�2����:#����j������l��ק�HݤP@��2�KP��z&m��v?Qw�������3�m�X+b���r�j��ܢt�R�����Qzn�k����Ǣ�p�������R�@r
Behavioral task
behavioral1
Sample
28c285656ef57f12444c427821e39c88e5dd4bdd6b7d82ec2ca7bedf6d418731.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
28c285656ef57f12444c427821e39c88e5dd4bdd6b7d82ec2ca7bedf6d418731.exe
Resource
win10v2004-20220812-en
General
-
Target
28c285656ef57f12444c427821e39c88e5dd4bdd6b7d82ec2ca7bedf6d418731
-
Size
688KB
-
MD5
0cdd8d1d2925a99e130ba43106d190e0
-
SHA1
67ad628a010f3de62a0a75d9cba9887aba498580
-
SHA256
28c285656ef57f12444c427821e39c88e5dd4bdd6b7d82ec2ca7bedf6d418731
-
SHA512
b27244ba4ea311ea544cedcde775dde6c92a7b60998b87a7ba3c7e712b77d25a67089359ba41f4030549073becbc4768f25c48d7a5169cc058a1bf25f08f2f52
-
SSDEEP
12288:a72CqvKRN7yo7SYDUWnwo18CusrZLVHWaGAbXs1Go9BEq/nyjNCQ9Psudam6:I6a7pSun3tbrJhGArKLwQyjFim6
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
28c285656ef57f12444c427821e39c88e5dd4bdd6b7d82ec2ca7bedf6d418731.exe windows x86
af97b72704c716e5b9494e7fc0614f9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord100
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 411KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 672KB - Virtual size: 671KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE