�$:qB���m���X�#��ߊ��w�����fؒk*t-���.~4$b���Lt_����Z6)��M��w�N8oV�t��yH`���y(����8���M�̹M��ӻj������Šf����enZX&�ᷝ`@�]�X>G���ޢݽ�Q�.~po�k�߬?c���E�e��, ����v�Y���he�����z�/ȩD�.���[дH;0h��"N�PKE)�F������)�MJ��`�Kʡ�|�W�C*���2F9�����E���ܝi�v#�m������Kx́tz[C'�s^I����Iٰ��_����[q�b:�`�f�3D~�Xwe|�����n������3HE>!c���V�w���0`�u����Z\c���c-k����#֑/���F����p���+�|��j��VSu��.e>%.W%�A��<��̬�����D��j����&��������/;�h'����%��Ҕ�m�N���p�퍪gvq��8�l�9���;TY�Cj�p�6��/�L(7V>b/��#�'���Ȧ,l��/R���E��z��g�Dad���v� 6Q�"�����b|d���O�F|��0q��Zk��Ə��H�� nҗ�-^kx7�.�;|i�$t��OO��w��A+����8ŗ�)�@X~G(Kv����X��0��>p(t�T�1��� ������MF�9�>6��o�ӹNS��qJ�����l�.XO�:j.G]x2&&��D�Ƣ"k!e�����>�|�g������GĆ|�yN���b4����huv�r�B���B��.Ӆ�C�29 nƳ��"8v�ft[L,�T�A?�0����`��NX��\���d�gA��{2W�L`Y">"~�j��s�\�C�|�11��i�j/�k;�BOi�������)x�"*�O:�|�J�<SjD�r���C8��F 誡#��P�{�.+��ʯ�t��T�>L������X�Ы�4�� ��X�� ���f�N���-`f�"J�|I��o��n�����������Z����\`�,�=�b��ڍ���8�5�V����ώ=�"������$���������n\I��Q�2�VCj��1��lس�&���k"k��1�[��,Ldž� �*MK��{_t}j����ڽ��B�p�b)T��O����~ ��p���=��AH�E1�s�rn�x�.*F�YU���K����h�:�PɈN��k�e��Ζ���֎ ��HK�����NEUPwU��~�ԇ�C���F�{��;�&�c���@ϴ�mΈ��b�͟���t�k�ĺ�zP��*�����W����d�tu;���M���!Γ�����K�������7�[�7C~7]!0r���\�����9�s<K�A1��U�����������1^�Կ��y�����i;S�s6�A������͍b�T ZYE2���Ҳ���<���M�=- 9�-�O`y������|��eK�b9��^��G�1�Ϙࢾ�|֬#��E��v$�q���t#��Y?s�H��3����A"�ɠ��)C�k�&�7�^�.� �B����J�$Y6D�Lk���Vn�}ɑ{� ��MQ�OIa���4wY*������K��X�_�V�[��pޏ�*5��R<]C��%��b���\�"Yl��Ga�W�]�$��zI"���Np�(�av�"��|oڠ���ʪ�ܔ�o�%tzON�YU�τa��?�)�V���Nk'���ɥGp������Xd@v����?���x_I"n��T^t�f�� �T��&Ѯ�I ��%6X� ���k[�T��v�- ���Bc�6G1���G^=*\�1^��7Z��4L �7�{��H�lDP>giϏ�3�h(%\hT��[]t��_^��y�t�}�nEic��Ԅ�7�\N��9�J��$L�4:���B�A��ǻ�$���>\=d�2�:rx���/���\�� ���1c��˸^�E� Q)��^����8��A���W���,#�8��!Dr�i �_.��P�JaO�(�� ��'qİ�\�/��sq���D�%hš���7C�zd�{��@�������z:���ʄ��[�����].9v/QU�z ���B��S����5��omd���� {/P3��_VlZx��$��~S�������7V���)*�} }T:Hb�!+�g�&��B��o��;f�3S���k�=���?u �����؉ w�G�n�&F�5�A����h�ֱT�%<Kk���\��2��~%�T������>=d=+���� 2&k+�7�K��2U��F�T�2��Ђ��;� �"p��~'`�P�$%�N�N����!ݬ惡T�[������59tFhRƋ����}��)T�Q*,����K�fwUw۟���]�Q}҂��v!��v�Z��⢔���� /�al�EA��"�� �t�$^83Ç0��0Ӣ��F+���Na(�Hgپx��)����m��_�nu�:��}ޭ�*����6�̿�i�ۼ�{�a��Z~���1����)zS���y�CV�y��/(�5���*M�P/y����'%�C��ί�w��km�Eb�Ű?�i�R��>���E`�"<S*�Ow�@�X�1�_�ടTJ���*"xCX�ۿ�!%#@e>���%H��N����_���D�e忊�i��gܡ^���}��sS�����,�g�JQ7�;Ľ6)�#|�k����T��F��1�Xܼ�ʝ�W�V"ե���_G�M��qw�%:���ÿ�w퀧��`>cd�}\h�b�V�v�$,G�q��'�+�yP�f�N���J�� Ʃb��-�x�!L>|�["��K�r�(�;�9'-���E�Z����'+ވ�r�O{��a�&�ut��b�Ǝ-���S3{x����z^>��� ����*t�p�#�ĔII朒yO0(.� c���R/Ƒ������L�d;_�2��L� ��-��S$�%F���D�a��9��Q�*ՌP�����i;6����̖��<��ҹ����@6]�[mŠg�B��`m+%�R���q��7Ž��F}��R�둀0��9�_�.Ĕ9��63��
Behavioral task
behavioral1
Sample
9281a44e8221cb028cd4256ce7c50d9051a5bf86cd0a8bdbb8a7bf042352789a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9281a44e8221cb028cd4256ce7c50d9051a5bf86cd0a8bdbb8a7bf042352789a.exe
Resource
win10v2004-20220812-en
General
-
Target
9281a44e8221cb028cd4256ce7c50d9051a5bf86cd0a8bdbb8a7bf042352789a
-
Size
240KB
-
MD5
0969399e748b0c3b141a5494f3f70f40
-
SHA1
71dd69038bebdc776b4db0101cf187a45f2c7f98
-
SHA256
9281a44e8221cb028cd4256ce7c50d9051a5bf86cd0a8bdbb8a7bf042352789a
-
SHA512
c0741d13894d0b169e8354512b246f1644682016a5a50c0f86cfab366a4593772f09b285481c18982d8ef9ad34edd4772e141a7081ab71a0ca495ca5dfd1613f
-
SSDEEP
6144:KnImQ9TS1ecmdhOy3KhAXzEQe6WIUvij:Kn1Q9mnmWoU2z26Wnvi
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9281a44e8221cb028cd4256ce7c50d9051a5bf86cd0a8bdbb8a7bf042352789a.exe windows x86
f96440580f44ff5191d3849e5b520878
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord600
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 228KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE