e��(��S�I����7%�ię��j��֙��*���z�2&�ޕx� �P�>�xF��ayG�V}-����z����%�[���;!Ǽ��@�M��@��S�pΆaOT�aLTV�p��H ��k����� � w��j�X?32\�k�����`�sQ"If��@�ׇ�����:4�O ��sй> W{���F5�{-_��-�Q����ad���D��H�W�#�`b�=��5�T}�жR�P6ᬀ��*�k�yX�iO>��s�}�u�f!��Ď!�{P'��n��2%R�/i��?V O���0*�`��|v7�^�WF9��̺-��7Tr-l����T���\Zt�o��ֽ�ob�gia����gc�p�P��Xǫ��Ri.��W� ڡ��U�0�2�^S3M$w:�"{*v��,�K϶A߬�Qq�����or���N�����U ��8�j R�A��p=X�����)��Z� R'�U�륒�n�|L5?].���1����:H������/_�YO���^��U-j�� ���9�@U�0d��T����+���P�8�`��C~��J@���l�䒁�wp�����_�b2��C�܀4�?'�R�'�y�q��/�)��=K 6@��*��0�D��'r�:m)����3���q��m�Qd�'�`��Na$=>�Z�EO�O�����1y�_o Ѓ�H��5�|���xDm�t�c��^�U�����eb���lq�[cA��X8Q ���Z72Z��^���A�Ed�~�5���X ,ᶀ��:X]ቔ�&�B�M6B?G�yv��\�JY]&�W�t%�����P���zG� �m��K$ޕ�+wo�,��@�x��(��j��{�0���r���"N`0g@7od#�ek���9^s9TV���8�E*�O����R�B�k`�r)��ޗ��K?gc��q5��ۘ��_�@�{��Du،~v0Ŝz�s��!8f�ԭK��x3l��Y����&/g��[��1t]o}�V \�U��!1v"�Z%l3���w5U@�n�O��n�đ�C*����~�?M0U�n�JZ-�$�c��ċ ���+��/O*^��Փ�Z-�]����:�T0=$J��ķ�#��h� �:]�-� �,�%����Ҳ�����W�8��f�RY���(c-)\(��Չ�_|=rq���P�nI�5���4�e���_l8Lh�D�m�� S���-��3z���~�����g�>@�E�Nj(<�5�o�^D��#����ҏ]"ڸ�=x�o��F?�3#�3��{���� 7�J#l��ꑫ���bju��CTBf շ��aZi���|+���0�Wp.�?�q�-���XrI#[���a�[�~�����]p�l;��"M�������9x���/��?�d!�ɯ.f����}xBs�� so^��� ��G�%����1J�R �����t�����F0|�#���|>������a�"V�2�#4��9�e-{83�2Ƈ,Hk!ʠl�'������ı1K�A�v�����h�9��l�����Z�p�rϮR��3�.Dkg����U��8n5����l��-��|�2�:(��{����P�j��z㒸�hK�Ѷ8L�b�wO�v����F�9��L�U�9�%L� H����N�T��Í���do~� A2o܍�d�KL�ܨ�� �n�������lgg��z��<q�t��G������������bKg�4���/MX;&a�� /��[<O$+��\����Wg���T}�H�j� ��bI�,¤0�>��� .b����.�)������nꝤ�\쯆������ʺT��t��_32?ŵ��ӂB�~�/v_�o7�V��1����� �{�n!�e��5�ԉc���PĮ`�R�)G2�����I���L��L��e`�]a�@��^`�������ځ�%�p�%:��~� ��_��c��N<a����/�P�IS��lR���'�Hz�?����"�ǼK�;4����!8�B�+�i%ڿ�pl�F�#���#r��E'�>[�3l�����-/~��}j��>#�S���$��h;UI�$� AI�k�`�8�����̰O�h�@L#�)�Z�܇�����.��� ��}nӤ���83"�����D�#>�Ƕ<�� bEsZ~�SG@�݄eB���c����ٳc�c�����|�#/><��B���� �P�[���@c�i~�*<T8��^��(y� ��t0�O����� c ��.�r��$��E���%A(�͜�|�FoD�}E+y`.h��ƌ#�/1���R���&K�ƙa���۰?�^C|V�?���/0�Ȋ�x{9����S<,IGK�SNK���SE���V�������`��)_$r��+���M(����iG �c)�؟ijǥGCnXSx�c������x�B�W��Ǻ(@����=��x�B�6"�ޮs(�6>����F$�}]� �K�ͧ�S��f�Ǜj�z8 k@h�|?q��!g�p�o��L3z|zrv���9�w�X�?^Ci����33ÀX|���o�h�����딳 gr�*��2���q!f��6�Rݍ �}����:���[�Ʃ}�"�*J��+o�/:�Z�@����w���,#��{F�.� C A�i&�q̲g����z���Ӽ1o�'���vy)- �:��|Ew���yZ?����9˽:�-�]�;MO=6�"Dp���8�4���Jjyʝ��"�Z�Λ�"!��p3�5�DCM�+~��xqQ �^���H�)!�L�7&Bz9�6��m]E�8�xO:T�ەڧTR��K�p(3�$�ODu�Q��y���ѻ)Yt��KW�����t�"!1�Z1h�m4�@/(j�q�y=�����J_=-O����.X��>i\ �� ��MZm�Q�r� w4�G8�\Ϣ���'�dY� �g��uBi�r����C��4Z�R�H�SJ�U畬�-ܲ*�ӆ�7����/�Z8�2�:�SM��1�S�%�'���u|���'Bb&T���mA<��D�s�� }��ĩ�w,��1v��#`:T�<<_�
Behavioral task
behavioral1
Sample
5346c131beb08e7d4a8538496e0ebe8dec1a558a6a2d96b3d9461d006be1546c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5346c131beb08e7d4a8538496e0ebe8dec1a558a6a2d96b3d9461d006be1546c.exe
Resource
win10v2004-20220812-en
General
-
Target
5346c131beb08e7d4a8538496e0ebe8dec1a558a6a2d96b3d9461d006be1546c
-
Size
692KB
-
MD5
0814816efb1f2255d53da3ad0c9f8790
-
SHA1
40b343b57bdbe48c56a31b5d11cea32d47fed37b
-
SHA256
5346c131beb08e7d4a8538496e0ebe8dec1a558a6a2d96b3d9461d006be1546c
-
SHA512
84762e52debfb7972036554e5cdda0e09e6492aeaf47e7b52991797b375dcd74fd48b8d5dec8dc69405726be8e2d1583003fea3d39e0ecb2d8e71d7e51131db8
-
SSDEEP
12288:fWkkt/BLNB1FF299eWieF8JuCe7gUCFVb1MGyknaA/fwsP:dktZtFFATWuC+g7XbOGXnaET
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
5346c131beb08e7d4a8538496e0ebe8dec1a558a6a2d96b3d9461d006be1546c.exe windows x86
f6b25597879f2c5089e9a09b835333d5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord520
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 412KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 676KB - Virtual size: 673KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE