ֶ�[گ>������Ĭ���i���`6"=�sMu��T��0����A3UGO}��ϊgWi�$��c���o����7Uj�>�K��]���ݪ���/�Q#�3�O� �wM��}dV�8�>L�o�)RU��8Ar��F��W���Z�� ��6�܅D�� ��X2a��R�a(�(@��� �Hċ��0���6Zpvu�È��"$����S��Vj|��n��J|�w�?ڟh`��9V.��0Q�2l����Gи�-���]�lwBլ��!W�:V?kz�͉kl\���h�ܦ(��m�Q�b�3 ~�b�~��h#�6�ۦn/��_*�X�V�.��-sZ��EG\M%?`-���5���9/��<�@9�η_��bE����Sl�wr���N9&����Õ�q)�C\[���Oe�/¡_h�Z������.���2����<ך �ڞ&���`Zi~@8Z�>��u�~E��-��cr5+�oi[��g'^�gHN���g�C;�����gl7�GK�L��g���q�^(��4���r���S�� �۰/?k���z)FZ���@ ��C�O���?'&T��ĵMg¾��*��ϛpN���Л����g>J�U��;j��~�a�.s6�ӎ� ˢxJ=�\��6��Q��u��w��wF2:���A(9�q�w��[�6����V���8��d��iM6f!��9�lڌ� 8�oZ���"pט��"x�Ê����֎�<S�mq&:�OE��A�Ƒ(;��X9Է�@en����j�7�%Z'�ZŃ9>��1dn�|��h)�Z�!��V7 ���W#qM������i��^�T����BB���s7��χ�S��]�w�P�U�l��&��ZNJ8�6�e�ςD��8�ZS��]� ��+VJ6YM���H���rj�l���L�x�j������8�l�>k�N+��\�sLm����JzO�o27C?߀�c����St ;uK�k��l�уO�r��,��8�����*9��>��;�}����a5:�W'��7�^�&����N��Sdb���3�)�CC�����+��������*�Z]�8��ج*")d g߶"�⭁H��Ohe�:q��ަ�t-�w���Ƕؙ/���D ��}�H"��G;�oHf�%�@���5��i�yL�C���^o��8���E%�F*Ȩ��2��\�0�*�'�]lYX��h�U�~݂8�,��љ�s�H^����Ɲ��Kp�� ��M��۷�d�O��B*`/a[Q/���X�����CJ��2���+���G‿� ���A�Oq ?b �."U�1��.��9�$�[.Ʊ��W���Q�f�FlQT��*���u0���� ��������*#�{�e���w#Qn��bi0Yb�+pT��U�J:)W@=���H߶EYl��Z7��)�mB�^iX�������zh�DX��9tU:c�=�>*NĠ�X]Ɛ ������U�q�plM6~�,8?[���ED�:k�X���� ,�ȕmaNz!����c�s�?�iá�o��n�bͲqV��֟���tS�j_EB�C�p���+E���@�,��bǜ\��v$e8���e s����j���@�o0AV��Y�� F ����8q,bj�7/2˗�`�S��a3��і�b��R��ĝ�6~�X�y�|Y�WIB��Ϊ�/��!2�m�]:c�*�J�wN_��BLJ�������,��̓-�|J�։���>�wꎄ�h�2UdT�*"���f�]�?�vuG�sPG�:n�M�]y�[{�KO��1��4]�RH���ѻ�g"w^V��}֣�_�̾}� ���#=b�<�%7��EWp�jg���]ɛ��ˀ_{6f^���:�ª����2�(�*����H��gq�X�/������Y�˙����mBk1���/�*�7�ʠ![{�'���9������L���s������ ���&��M�.��/���xt��kIs����3!���4z��z������ǡA����M���]u�}oe�y���O��в� r����%�^�����E��8=�IP�����W������������5v\�wR>�wՠCJ�j�(���B�յ)Ayo*�i���=�=�Z�c�|�Ͽ�n"s��cZmT�e��LG�m5=g=�/� j���e�E��a�?pڽ�M�B�v���K#��b�)4���Û��DRL�QD�|w�L�DO�/T ���j��k���T����h�5N-|K�rSY��^��*��CřN����t����� R�R�7p�i$����);F�(wW!�mv�����l����5CAY�o+4S��s*w �˫X���"�b���I���LU[3�m�E��u��V�}���Jd=��#M ��#�J{�)M�>�2��|���D��\8ׇ+%"��u������l������ϛ� Qi/!� Q���v�����@���4�f�'"��> �U 9悖�Z�U�T�NA�.κ�٘���E �5�<Q�3$�G/�Y��Y@���k��A��kGl^�ϴ�a��h%u./Z&2i<f1F�;�؛��܁���:%=�g����?���k*͵�=�H���ff�,_�t,ޮ������6$�����,!�GU���o�Lh� &�:�,��.��d����� �.�����c}�9yo�2zr�����-���.��KD��+��.���(�f��U�������#8f <�-WJ�� ��ܛE�g��7���4���g��"f>r�vk�36�N4�2����H��K�����BD4���_�?I��nU��J �e�h�cd�6��s}Ej����U%p�Kn!G�m?ln·�a����é�`���j�����;� ���<���IL[�&d�`�:C \�D/�=Q�$��yhMRw��f���[i��n؊/��f�"?6���*ۻ�(��m̀�ŕ]=�)�^d�NF�����@����<�U5��X���w��dt��*/=M�I,Hf4��GߝJ%�aL�m�#��p�Zr'��
Behavioral task
behavioral1
Sample
9b3fadd1f5641cc854478ea658f0cd390cc11b641e0b65c9468a139bb99588fc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9b3fadd1f5641cc854478ea658f0cd390cc11b641e0b65c9468a139bb99588fc.exe
Resource
win10v2004-20221111-en
General
-
Target
9b3fadd1f5641cc854478ea658f0cd390cc11b641e0b65c9468a139bb99588fc
-
Size
548KB
-
MD5
09cff0f64832210af25ced16421fbc80
-
SHA1
a59f19a0beef2be2f9ca2298343a459388014252
-
SHA256
9b3fadd1f5641cc854478ea658f0cd390cc11b641e0b65c9468a139bb99588fc
-
SHA512
6ade34aa512fb7c72d9ef79e75fb9130888e86830efe39d3a826dd15a604ad38cb4b3750fa7276b9b78e3cbe2b84dbd16b2d42b91aef96c2c3c1a9a0d722907c
-
SSDEEP
12288:6fTIPHXyRGBmjnnSAaZW3uMQFYXOxM51itTS4CMbOe5J+HYu:OTPcBmjnnUOOGXQOe+Y
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9b3fadd1f5641cc854478ea658f0cd390cc11b641e0b65c9468a139bb99588fc.exe windows x86
7cf863b6fd4e897e39bdb60a370a3983
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord588
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 532KB - Virtual size: 530KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE