�_�ʊ-�Ħ+- ��k����-}ҷ����٣�G�t��H�U{ Փ=�g��,2�Ȥ���H{��D9\drc���<�w����L��1�,�Z,��Qf���qI�Y��&�:���ē�:\� �*9]�_�`&})c����4��=���_�0�zX%���f#?�*ީ�By�py$�L���Y늢�kԦԓ���W���\�p=�ǰ&?ϲ��QD����V�����$�/$�d�u9b�<�~*��$�����V��GV�>���_�ۮ�.��4�#wP��rA8_��b���d}���謹�q���/ˑ��+��Yu�"+�𘕴f�l�?q�<>&�G����d=�����[��D�ߡ�![�n�Q��d�����I�/#Y��|s�K�1�£�ϏXF�n��f�˭22���f�G��y7P�1QRG4�Om`�)D5>V/f�e�+���ۓ���٘�c8A����G�c��/�X��ye6��2e2)ӂ����+�L�y(�,'�4�Z �<�I��T������wTڍYB��/Μ_X�F�����Ty��R��v�L+�������B�����J3���*Ϗ�Q��W*�A1.�!�8��� \?!����q��9����s��(�EA2聃��A��eY�7��@Q���ɛ4�p%��$�$��pO:H'$��@�K;@�N.X$��a~X�Qram.���������>���(|v��Bp-��q��o�+�����)wҼ*�YP����^tl��^�t�[����쀘I��iM�Q�C�2�@ � �� (N>��O��bhY��+J�d�D�L��a�*eX�W�0��ha��4k�W��~mS�`���4Qz����M���_�������d���߶��a���3��Z̘˩�IY�B���zɩM0�<3&���g�j�T��w`7~��{[.��Ɯ�Z��TG�& �|���g��ks=G1�=�ۧ������1CD;jO2`�zp�*�'�����Dx�A���߬i]��-�l)a�� ��%0�xH�ޱb���pQn�Y6�c,����1i�o?��g����LP�O�~��_���f���-!�N���¸���gk���Vl���Ҧ����u}�&���1�n ��D�vd��J��d8o�J�(zj��t�[d�o잚<Í�Sf�1�f� cV'��l;S }�gl/���I��ଆ��d�V��9�jtr���`f����˦!����t�{Fz�9�|F,2�䥞?��@��cuyMKӶqһ]�bx�'+������Đ���WU�gF8�y��w�����a���yA���?�(|V���;&i���8䩏Ï��?�4ۃ�JP_oJ����Ha�I�6M��y�G� �R��A�8ԝP��eMX%S�|�Q8D$������.a~u]g�����VЫ��<h�6!쫜m��e���F��bC�+c�C�}� T���E��G��f��Og�I�@M2��W�%pn�N���0������#b��I��r���\���$"+�-d�Q������Q��!�h.֧��W�����Jr��*���Ӷ����� �1��\�� >������O�2�Y��x��kf��5��F�*��N��鱖a�(�.��Ќ��K�߫�±��'���67����_���s�����o�i</M���0u ��$�Mi�k)�� ��4��B��y#Uԣ �T8|~W��4�WK�@��>�Sc��ӛ)IC���|F���TWz��l1�$��I�;_tҴ�����9$�Ɔ�}�2�G�{�ym8����`AkU1�&4�V��2�k��2�y1���Oi����)��b��'"��8� �F��\��e��jV;@��҂�ϏJ�K�ռ��5T^�eX߄���S9;ۤt*����h0U��R9��ݗ��3y����l�N02w ���A�kg�i��`/�W�g���o�y�@mINAs5��j�j��U�A:�*�܊c�7vM�(?G �/���g�BpC �MA��9��C��>�Z���1p9�:�\��� ��@�W��kV�2���`�iݦ7����9���Pd@�[Q\6��ab���om��� �%7�����@?��\D��o����'qF:�b����.���'*�k���o1bΡN�s�/YF����y��͍�i��F�m�^���z��*��|T���ޟ����:q�GUJ�$h�HJ�@�!J�3us�<Em맔��Ӎ�[5� *p)�OV�E9���jO8�}�<n"lŌc� Z,�&���N�< ����� pU��LE��nh��m6��������kD��l֣i+��xB����lA�?k6^���Ŵ�H�j �Z]����/�2N:GCR{�K���k���4� �)^�7�<�������͛����q��]�F��yۄ�u����S�~h�74I=�_�f�x����@*!�x��#�$8z���`�� ��?ڄ���'����::�<�|�ܔ�W�ti�g y\���dV)�IS艅��2��F����ox)U�a������+=l�/וzپ�[w�O�ŵ�?3��k�,dJ=� �������?���Tם*��!�K3� ����s�$�jN�����G�A5�\d^6S�N���:_ਚg&C�ۤ�Iz�jf�-�bX~���R����xe��4᠗�Z���q�o�"��sB�O3i��}*̿��t��K+�R�=�����o���P��^S��mc�+"����Z�s����%��d�e[6�Z�>m���U[� ������n������`.�V X, �?�Uy��AP]�V�������,�5��/��M�|J�f-��� g�x:9��y�1����y����Eݘ{��8�m�WC]��'_Ӆ�9l7�Q��p�A�T��m���u?������6N�@�fY#-ֶ������0�E��T��/{��D����2G���pY�9����NG��'��z-��X[�U������Ng��>$[���#wMT��}��iI��K��Å�6 �n�{ʕ�Ҫ0E#�o������{
Behavioral task
behavioral1
Sample
e9aaf6c009bfddf16df800690831bdf55d9328b41c7f3e11a770da5e899e1d4a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e9aaf6c009bfddf16df800690831bdf55d9328b41c7f3e11a770da5e899e1d4a.exe
Resource
win10v2004-20220812-en
General
-
Target
e9aaf6c009bfddf16df800690831bdf55d9328b41c7f3e11a770da5e899e1d4a
-
Size
696KB
-
MD5
06357ff7988c81953d43ca4875e54ab0
-
SHA1
6a46326e03484de26296ede42bb095a721e970c2
-
SHA256
e9aaf6c009bfddf16df800690831bdf55d9328b41c7f3e11a770da5e899e1d4a
-
SHA512
339c2bcef7eff64db34e49b3beace54396c3657478ae2825e6b22622b69dd325b18bb0b3924406f5ab184936e830ba4a49bce469abe1df025d140c8fdc14b372
-
SSDEEP
12288:aFBMLsC7yAc2NeAkrcGdWXeVrOSRekgqJ9dVL1UEhgi5mTGmOM2cFRSizbEfY3p8:IMLB3c2chAJOVrOSvgYZfgpTGmR3Siv6
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
e9aaf6c009bfddf16df800690831bdf55d9328b41c7f3e11a770da5e899e1d4a.exe windows x86
17fc8148a83e681e1ed618805c628c76
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord598
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 411KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 680KB - Virtual size: 677KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE