��Hv/��~"B~����V�&�>�]���$���J-��J>sB����{��in8���o�$R�����ʑ*���[�'^Ѳr����S5Li (�8 �-�9ёZ�cf�#��n�o���>ۯfG���?�Ώ]z�u@k�S����4&3o�C��y��A٪�����g��ZӉ�x&���h�C�ǶP�*���A�L^��q�Y�@�x� ���.v�d�W���;�q���K���=��D-����/�����>!��G>dP�k��0N����E<�����|��ɸŁ�$/��]�dc��-j�Ƽ�!G8����������c��{^J����n$9/ea!m�n�b��>*�N��Z6`B���B�:9��S�=�< E,L!�(�'��\�|�&ߜ�����^���t�#��?�ñǒ��� dW�����av3�����c�ڟ�+�X������0�":e��J{�!"�Pw�V�(�8�S��� �����B����[X�~�~t>T�)��&l�ƣP�'U�c7%���rl�bW��'�]��"K7����4J� *M��ec'���ψ"&�;:q���S%q3@�O��)�iK��S������_�4cŧ|F���p���aQ�� $b��0S���e��t�[.�fi:3�E$v �h�P�$�4$1y hW֧~Zm���7r�\�9��E*�n�-�g��-����Ak� )�ʙrz�6�ҁ(��(X@���z�If魹�g��lt�)}����~��w�9**j3 �*%�{���]<��O�w�q���%������E���5��������YV���.+h_����}a�Xf:�P9�.E���3�m5W��j@i_lz�h�E�c2bC�g �~/�x-�7R�\�r�$���C�u�o��*��*�����?`�u�dR�+v�ʺ}�8���Vr:sr] �0lq�K�%�ѱ�g�9�����͈!rO�%v�ƛ\�sF��|7��j�JA���Ϡ6��4�%�B:�[���gg 2;˹���)ػ�}Ă�CJ���;�>�??��O�-�s���(W�B�.ȿ�f<���1�!���d<�Q�����dG@Th��¢!G"��j�Fh�q��<��czy�� p2�c���%��-�L_����Ru��֙�-o�G�r4(x��KNU�]����1��Q����\u����;@����a���z����P,��H�D��)�u�6�z�OY��E���o�e���`b�nB���� ���.��$,����x�J3vf��M�����"a���ٴ��m�VW}(gX �b�v9?Y������C�H1����w(ꡕo��n�8K��d&~�06��%�I�gT�Wʥ+ڄ�@� �-{���^��jB�����=�EY,��f�Sbw|]ڭ�Ѕ{'H��=�1ĵb����$C 9|_����}D)d���^e���x��4�V��*�t@F�_���Kd)�{���"T�#)�r8�`h��ƱG�w�& Qh}����'����m�9���f d3h�:l�������ތ��O �骕�38�E�%��ݭ-��,�7��]�7��5G�e�S�@�<�v�����/�VS�k�$����Jv�lmR�34��Z�����?R:������7�|(J�����x%ْ��b�K){�6s���6FE�G����nE{�Ɲ/Ӥ������`�"g����Uis����te�����������p�[����i�+�P}�C��7n�~�Vx��*T�"�t�ب ҂��J������*�:!a������9�����wj\����@d�#N�-;��p�1Q�B�eƁ�4歼��/CD��u�C$)�]k&P1X���{���S����H"q�/�6L8�o\����J_�j^{�ۯu��Ԓ�c�0�������x���������V��G��":����M1��3���Hq�� ����v�O�d��-��܁���$�5�� "��B^�����~7�n��N�.!/�!�>&NR��b�%�qw �ԯ~ (u-��� �C��S�8wЪ̆yΰ��i��7����z�O�1?����jU���oM����j�X�2W S�F���0#A�.2Q!l���U{�L� 1ta=ǃ5��a]-����3~�I����^������r �o{��o�j�il����1�=�=��UT����Ѕ~l�kyl��Y�Z��n&�s�]�%��ߐ額_����5�����o�egem�PKS O#̘ua�E���3S����>�W ���i��-W�P�M�;ϺN2G�R�`I�O C�f�t���]�Iu�x9�⸏�R�H&�Y5���R�L��ȕ���%s��'�&ҥ�V����Hu�g�ޗ�psW"P�:0�pT�������;q��p½jg���e�ٶ"e���t��G����F��$g�L��kQ)�x����d����o\�p��$[�A��K6Z�HW����Ƞ�Isw��2�>w�\��ja��⁃6����.w&�Jq!��nX�|8hL�ց�;�5�^:�x|�N�!>4���o9ݑ�����������4�tF�f����K^��R3�(���i��,S�.hy���U�0�y~]v�kE��n ��#��N��0����W��WFľX��@nm�xʒ~���#N�sx��]��(��/�}��i�U� 4��~×�?�B�x9�� ��= �I� ҭ�QAM���Vʡ�]g�A���lD�hv�B�~VJ���zk��� D�,i��Lوۘ<+��t���E�$��ƌ*�ƨ�J����*��f��o���Za�UF�7�Ϊ{�.4�P�#H��W�a�������Zy��;M@���x"^�x��)�H�v'��\z��|��4����v�ɲ�����t���P~�r}�J��+�N�]�7I�ez��y�襩�աM�q�iwe4�I�u/�NSt'���n�x��J���v�/SPIƩ�����.TI�A���Լ���K��~�}����u� �F�g=���-�z^#���4Z����
Behavioral task
behavioral1
Sample
bf704e00a83ad75f5fc7a2c6bee2b45b0663203f4e63ccda79825ab6194061cd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bf704e00a83ad75f5fc7a2c6bee2b45b0663203f4e63ccda79825ab6194061cd.exe
Resource
win10v2004-20220812-en
General
-
Target
bf704e00a83ad75f5fc7a2c6bee2b45b0663203f4e63ccda79825ab6194061cd
-
Size
556KB
-
MD5
20c22d2d5d0c0f2e4b7293a8051c1cf0
-
SHA1
aba8bb4ad5fe100aa4acc279b5dea930a70b6954
-
SHA256
bf704e00a83ad75f5fc7a2c6bee2b45b0663203f4e63ccda79825ab6194061cd
-
SHA512
e556c2ac7980f53a2d87c1a6cf41e86a8d68c7370b8e9ce94e52252f53aa7a68786d580321edcf388cdde190b2780413098746b2e1d0a5e0526ed6af2d4163a7
-
SSDEEP
12288:0B7mSmbXE9P3EiVIpcKvpbn577ASgJb1AUscO57:0B75mbBIIpF1n5QRbxVO57
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
bf704e00a83ad75f5fc7a2c6bee2b45b0663203f4e63ccda79825ab6194061cd.exe windows x86
8ddd34fc0b375258f386d5acc27932d3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord698
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 311KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 540KB - Virtual size: 537KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE