���̌ѶwY]��K�=ˌfA��)�����"C��|���W��v �<t�B�Rޤ��( fa���?!�$��� r9g���l>,�sO������:mP��*^��և1�wmu�V�=yH?����c>M0.g1�C�.�V���D�6i�ܳ��]`�"��^e�$7��u��eAx�W�Vw�0�k>�����~7Y�)H�Փ ����wcG�`2�%��`ս\v7��g�ˋ�ߨ�(�-�G�r���0��i+�Ptsڟ˽J�����,^&�g�P���\i������}�c@R�����Km��i^������d,��m��{'�,Ϟ�8=���:��.�1���j,@7Q��@�4V��O��'�ֹ'5%lט)X��YWH\ӎ�t\mҪ�\Oi�r=P��.纄�kN�2+ȝZ�::x�,�oK��C�G��Z9��d������&���T���u ٪�/�"� �q9�=�e'&ܸ���#��'����7#��`��N���볛���~��TQHY{ */��ٶq^��>�������Ώ�F}~OC��OT���8*�pSqkU��o��L�oI�N�8Ӳ���&�ļ�j��QT)9K�A��x��Go��q���-X*�h&����i]��� gFA���d��:�� �[u-���*�K9���_i�Do@��aXI��� Wܩ���[��/F;uJH�u�l��}��;\9g���u]S���~1� ���3)�s���/*��j���%�XP���Q�u�u��G\�_�٪M�����j�j��qs_PAb�2;�g;���+�]�����v4�"�+� #���� �����O(B�ɧ�� ����\��ߨ���� ӊ7%ղ�MƄb�ٺh�������#��4���}�a|h�@����Q��ՠw^ھ���p���Z��K���v�7������<[Ye/;!��T��%B�����t�䆯:�(Ej���BCL�# Qq�l���M [oZ�a6hH1x*�j�D�)�;�G����8�;GKI$�v��駒,W�ԞzbQ�IP&�m�_(�o�LEH����;��|���"~AI��5*�k�!�<5~��v$��M��d;��do+> </��dZ"��?��i~p�>6��� �)gb�v,銗ekC�p��(S�k�3 ��fn!�UJ����*��B��_��;�Nm+��$I0{b�. �]�Ļ]�iӋ�r�Iq��S������Ѭ���I���9�b�cd�#�}��?34��(m���ys/,;QF��R�yUB۴�Y�a����-��w)ƽK*>�o-%�ΜfBT�FtN����z��:vy��1��p��dct/K/3��V� ��-䡧��@��3"�p��ߕ�ޫ�����t���E�A��,��46��-�s�U��0a�L�#8�9p��@{�D���F����aSI�x���n��=a���HلR�3�!${n�n�b �^��9ٛkb'�[���e��qtr���n�C�<�u�D�4�2jHW�㎂�3�ۃgN8u�{��[F�s`�cZuEG� wۯ^���.�2o`�F�ʺV���Ҥ�k��ɳ˴zn��q"�{R��8XX�h~x���S�Em��+��6l��� �W���Y�D��[ �����aa+�h��6+�8���Y1�Ǿ��Qxވ��k���H��%d�r����h�a3!$�z�Tے=8�]��fd��־9��y/SZ��pN3*�!��������G�vg ]�� ~�M��,>f��!}���[��Ir��Y�Hd��6�O�1�S+DVw���������*B�24�C�:����1�]SBj��g8���K�,S��7�R_m����T���9a������+ 4��`"-��u�B����/y���9Ѥ��a��}�if�մ��9�b��?D`@S4\�B59&]]:x��2 Z9�g���� ���#�v�2 �k��O�Z+0�Qj�o8�sK8 =���x(�������������nAc ��+������;~:H�1:'��&8"*OxQ�l3���b� �'���"p��� �D���;˨�����V�-�b�m{���>(�k�^68��Њ:t������kJ��F�������c"C� �����DE� ���5�bv8�_�k����&龙D�����tl�?�^ iڄa�-�`�� �̞�g���e��צ���O�I�'�ɛgi��n�:�/6��h<?I���%���=u�����<��Y�z��>�9[X�yZ��VgHx�[E�M�ǜ3�P�Eֿ!�d8ٚ˗t�D�^KȜ��H[�h���c���!z�l��O����5��e\�m�xq/�����^���^O�Ƙ"28DԄ0�Kp�lC!���i�S-�c���<ǯmg�R,�8/$`$��=���u�~Ґ��J rU�)F�4�>LmZ��TӮE[��a�� ��U�iB��}��ջY������sN�t�d哣 �#0|�#C��*�Q�ʣ��#���O^�-4b*���t�]���c�����ڽ��c�\���?��5o�buE����l�X�;ܪǕ������h�G�H�']E��â(����]�zo�P���S�[p���@�����۫��` `����م�+B&�R���F���L'��m!i%���܃茍�}D9����@��lٓ�\ 'BK-`,FS��ue�7��`�����5�S1��_, �(�ǽ�����z��K�2�jucF� (��&h�6]2خD��R�eO�Bّ>{����`������G�sP�e��V(�CtO�� ^�uZ`4���6��VJ_�/�3��JtR���}�k���z�Sr���-�����*�.\�V����:8=���K8�&���]�����ܭ꼏<x�&);աz����A[���0���:�� +���V4j9D����2F94� w��W�"����R��LH%��h`9�ք|_������t�c�._�;���O�b����V��#����'����Nח�j"���v���v�"��BT֔&�A�g�b3�
Behavioral task
behavioral1
Sample
aa95c049a2b5f2d61aea008ed0c44500075190a96ddec63780c37cc2790a321d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aa95c049a2b5f2d61aea008ed0c44500075190a96ddec63780c37cc2790a321d.exe
Resource
win10v2004-20220812-en
General
-
Target
aa95c049a2b5f2d61aea008ed0c44500075190a96ddec63780c37cc2790a321d
-
Size
560KB
-
MD5
120f197c6f854b2c427790a26b0213b0
-
SHA1
472df1b96580a439ca585a5f3597956e6eac6b60
-
SHA256
aa95c049a2b5f2d61aea008ed0c44500075190a96ddec63780c37cc2790a321d
-
SHA512
d8a531308c03846d8686a18f72be7b390f88f296dc599ac7fb0302f5c9edefe89b998090a100c60a8a012e7ff033c40dbafa8eba49ad1140b3695469e254ac1f
-
SSDEEP
12288:05/sU7fAG1OuRbAq69yWk1IN7YgjiI2yDpUl9xKc84FsnWx7aHN:iTfFUQAHk1ItiRyD2lKI41t
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
aa95c049a2b5f2d61aea008ed0c44500075190a96ddec63780c37cc2790a321d.exe windows x86
3b69ffcf5eca07cfcbdba348b095003a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord612
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 313KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 544KB - Virtual size: 540KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE