B��f&W/6X:�W�/�zz��0���_Y<Z�ELDN�0mP}�;�>hq����)�j��r���E2��׀E-�>g�����2��k?�(xa���7*�;���e��SF�jۜ>�Hl!�qi(��Mb~Yp��?e,w�&`>tHZ�C8�̢-�;�h�@QK��r���gh�;��gA�'�^�yN��2��|��D��Q|es_ޢ�0�ⴜ�c]�ʅ`��0�#�����b��W�)2�'s�����)(���L�a�'����`��\f*���\h|zL��7p��5�����"8>l�%��V\��rCR����]���u"��tZy���iMN~M!�57p?b�2�S�&��#����m��~�7' ZI�� ���j7�f��r8��-F&㳲�lY�]��*�<o�����N��s_ʵ��8Σ��ug8��0��*'8���f�F��M����Qm��"��z:p[��H�1C�k�s!�k?���JyJH���Hr)�������ǯ��f� �/�s�q�2l4[[�l�l���)��tUK�"��aզ�Q-`�d������ �]� ��Q�q�S��D��P�cBN���K���d><)��V�s� &ޱ4)�3�=�ZKeI �����:%CEE��yh�%=�?P�Öcd�`�MM����ֺ��0�F�~M�S?��ܴ�{f?J�6"%���B�%������^��d�-�߯��0�v3� ⦵(������v�,�b% l.x��^�j�������>n�"#'�Օ.X# ��͔�,~/j���zoKIt3����:]^@�^��4x�����I-�ГX����+xyd�f��j�|�������i��5�_ɐ;�/���=��I��S�6>S�jj��)EL��JX��-��d��=d��m��safl�ɾ�/ ��?��@V���!���- z���Gs�/ Z��Tȭ�5�K�ߕ����"��u ��ȼ$�D���A��Xa����vԘ��^+�����Gck`�g����.���P�"�<D�m�]�2�#CT�j���* )�(@ճ��� Y#�sY�7��iY��9�4�=?�h.�{���N_�q�o�����,�C������)U3�� �'���5����O�,*��?A{�ƽ��[���'LȄY��L��OŵZ�J���c��jM�� %��Y��✌���O^��y�̭ZÛ]̊�`���-�{f�R0��� 3�b��z�TUT|'���@��VvC|��l�,��-R�ҧ����\��=�ج���P��f�&�lt.׆����=���ӡ��Tc���](_2��� �s�n. ������.��`~Frj��im�����}$����9"�wnPU"�Y�2W�5�7*��r�|YpS���EǑ�@���� >�Q����:��88�o���X =�&c\�ׯK<K:d�֞,&%&������m?&�_$Xk����Y�)�m+�w�R0p�'�|A!Ӎ㈌� <Sp���M��`�6�Ѐ���B��Q��ĦK�+�Ea��*am;�pF��dN�!�8��iw�W��W�ɥ _u#�c��f��y��S���\l��f���>0�o3>�;�+ՙ�L�F��W��nҰ�t.nv&e5��l�V�Y����{G_6��@!�#SkM�lɯT��uVaiY�3>���L���k<�}P��EM�u�b-X����4��������@���8�".!%�P��'N��E.M1Kh+�h����!��@l��������Y���`��!���Z��5�M`̶��.�$-��}t9_����?qz��{>/����^�����D��}����] �-�"�98������7��@6b%���V �jQL](��$�K7�в� �5*�|[Je"� C;>/V�n�Z��pU� #�o�Adz�L�z�I�Oj��gR���*��&���i����%(P�0`4X�5����y�e��{�%����@x�[x=�xT�R�5r �p� �_�qCkQ9|�h�7��#�Șx jR���ا"��Z�5�NfLa.�=r�o�y" ��yv^;��:&�;�w.Zw���gG!kET�%�\8�W)�C�x�J���Q8"gÎI��\�K�^�&�+A��&�۾�$LLǦ��#�C����7c��mQUE�|K��7'�{v�3����H~S<I�ߠJ.���M���gs���B�a���t��;]ጿ�y��NOm}����w�5��M�thg:�|V�p�&�g���b���+�FU��lg�^}��D��bd ݞ�\{d�t3QĐ3��� gf.�#����8��X�nF�֠#��sv \��g&4��p��M`�l{id!F9��l�g,$�W�1�0p�tQ� ���xJ�Ʈ�tÈ� ��/ɵ�R�d�<�6���%�2��yD����|���BV�R� �9��F˺�{��]V���X�E��kc��MoXۺ�ԃxMZ�~^��'�z]��Y�E��Pu%e��-,G�{�6�-T�"kY?b^�kIirt��C:��-���J�S�3�'�߅��B�g=� �U�ETK�g8���D3�� W��\���E'�l�:�����W��փ����3�q}Mc����ak��#���P��!���<m��ʯ�.\:'20����2��rS��_ �h����g�&5���4j=�Twkj�"�n�N ���[�Dx���bi�����;ۙ&��Mj��-X��v�� ���w8��ޝs�)[� �G��X���/4>$!d��n~7p�4`M�-���^���>���[��@�P�}�sb��_��뚦��l�Ej dK�81S���z�rω�T�Rͪ��7�Yݐ_A�����6�v�+�����i� �5F�F�h4������b���j��� ���2��<��o!wA7�JDf�YF��ԑi��>N[_��Eje�ޅ7p�{?����e�C`��[�K����,5 �K�Ҙ�?���]������o�CP�љ�)�� ݆�Aj�����1�ZZ$���i��1��˗2�w�̹�����,�ǚ��d�#؛���-���m
Behavioral task
behavioral1
Sample
efb396e2df0393291517c4f992fc5d1197bf960d2e143391d2131a2ffc597a28.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
efb396e2df0393291517c4f992fc5d1197bf960d2e143391d2131a2ffc597a28.exe
Resource
win10v2004-20220901-en
General
-
Target
efb396e2df0393291517c4f992fc5d1197bf960d2e143391d2131a2ffc597a28
-
Size
540KB
-
MD5
1deecde5c208e9495fd51e005b733860
-
SHA1
2d11ba0e8ff392d55365bdfb1bfab161656e5163
-
SHA256
efb396e2df0393291517c4f992fc5d1197bf960d2e143391d2131a2ffc597a28
-
SHA512
99d6c86c969deb641e4452a991dd9335262120305b8fd29f729b78e8593042d4624df496e65223099e0f75d70b712c1ac468bba5f20ed314bf398d82e27e5c1f
-
SSDEEP
12288:a00jvZpDXstASKUzOAG7CwkQdXcmEVm/4IztIIItBDWTQN:N0jbCdvzdCT3X/A49IjWT0
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
efb396e2df0393291517c4f992fc5d1197bf960d2e143391d2131a2ffc597a28.exe windows x86
787b8bc2a64dbfa5aeaa400f489bd901
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord631
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 524KB - Virtual size: 522KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE