���<�������=�H�5A�| :� �m��űP��s�B�=�Ί���'��̟�q3��V���\U� X�b�܇5r��y,�v�=wX��2M��ȅH��o�<⅒>3�$�B1��N����6�v�U'c�����AuD�������"��� ����Q+�o96Dž�!ӓ�A�n��+Am=�^�D1�T9��G�ǂ�f ��'������?�3#ѩi!<��('hߐ0#�Q��בwznE{��wWx�\錮%�Z�q�X��<d�U9@�}�HXƜIt�����;#�Q۞�-�Y�Q��LL��T�Z��F�d&�O,�.�q�����Ǡ�~���>CA�K6���$��i��o0kvV+�g�藺�V��$5${A�G0�ݲ^;�IM/�� ��߹Y��o}e�Ʉ�H�:!��g0�s�_ l���wW� n��7duKF> �kөkNƗ�<���_���/oI�yo�=�N䨺^_p�ipN�BW��U_PJ����.Luth��Ox�}oQF��i�B*�f��ȏ�L��҄����?_G}�5J3��?Y<ۣ� ���:`���%�a��J_�!��yy}`;I�y�����w4��x�����B=j� H�N��CT� ��������3��@/��ZH�;����@FF[?��R�f����"~ݯ�}/Oig�j3^-����6��_�\�]y��|�Yۤ��4�"�M����Æ�X�y���>��I���� ��S2�Z����srD�U�:��.��I`o��C�g؏ϻF"��2Y���M^�l�I^�7��Dt}�Ɖ�����s��$+jdD��i�o+f��9E����w�d���J(Ɗ�*�%Q�(�w~�V�_m=ߨWZ�C�i�5T=��B��.K`��|ϔ�Ftef=��uN�(���`+8�5#OO=���[�>��؈�=�:����<����q�|�u��|G��{��è��ݣ+��������*�����+!�tN���g8��]��F㕳�q�1��qQ�G�B;�V�<���r�)�?�sO��6��XWr����̽*fo�'��-�OP�Y�ofVilV�v�x��������P§P�#��Z�Ī:�4���b���w P-8�����}���)�����lo-����~�3���*3����d$������ �����r�� "�.+���x�r3�|�fi%�{���(0�G����_ m������rlr��,v-��0�ŀ<�h��D�5'سP^�A��F�D��A;-����ֹ����ݰc�>�]�,}:�R.Cmz:$27�b�3�Q��(�]��p\�S?�8*:�8.bl�n����xb��8�gFw+\�K���C�_>�\��v��G$+��5eF�A���/DW��)�h�M�:�)i�PA�<��+88Ů]��[{����&�B�=a�����[H0̞a���h�ٖ�`�!N���֮n/gGnD��wJH֧1E:d�*QǜZ���=t���|�Lʁ�i}� ���}O�5}�|MS|��S�� x�� Ձ�g�$*�8�;�� WXs���A㿓~ `��������')#tl���M (��Pp�����N�Ƨ{33d�?��BȔ��� 9�6�=�^�4<��{������C� Gy����y� (���(�#v��$�(�7���'��s������`�Bz<�a���g�V�&�~�F���Z��2 ����Ė-����f��;��\0��IϽLd�'�;��+���l��rm;G��Ъ��C}I�8j�$������;�jV)Mw0�&��G#:s���kI�5&Ƈ��{�B��*{� &&}2H��l`���n8�W4����ĥˁ�0�|���r��{�����@O�Wq1�G�ai+��̟ߑ��Y�='Id@�`W�C%�� �_gn�+�m�fvũhД�s�aN�X4I��@[��j�Z�N}\1��I[��>��qs��|����#�v,yg�Q����\�\��8�+���1O/�T�PT�|̗����,�!�Wlĵ�C�>�9d�C����AH�a���U-_ d��/��w��Gt93S����t�%\[]��?��b���6�_zgX$���z�U%L}�.��;� r���x��{LxR ^&�������BNN/x�����@.�:^�����Ģ(}�|T�����Z��_��yK?��l��Mk�D�H���$ղ8�?��"�-ȝT�A�[j���i�lx�x�X���drj<�sݷ0��i �� �y�7��O�c�L@��1���3�9� �3��=��)���ƶ�N�^;��5j4?� ���_��X��D㮼 ���ULh�Ů~u�G B�,�k<IB氍�巎8;[��7Z�-�e����n��Xfw) ��y�_���@>���c�W���m�e~���� {SR�<>K }����t�t������2���*5.}s��)�J���Rĵ�δ�E�^��[���u�~㟦���J�O;GF3�������y�u�%�bXc��RF_�!�k�U�JwM]�R���Ӌm��ዥ���Ά��q�,�Ը�,��}trP�x!�ng������|u��`��e}��������*������&:�-��ޠi��rm����]bs�W%���Y'=l\�J?�G�̰滏��{�����g� B:�o`,_��Z����+�!>限D��/x���l��v�&X� ����pYRX+T믠��VE5>�iY�Q�P�����p) ����`�3��c��:��4��<r�ی'W}þ�-┑�q�;��q&���k����y@-�uݲ�����1�ڀ��nK=H+����w�����[����S��XG������r�1�HF��u�����@:���S��l.�h�ŷ��z�v0R�Iz6Q�F�\���<Sx�Q��\Ԩ*���� �&&k x~�x&�o?{���������Q6ٻj.`S�xo�Y�����'BО�>V��K�X��SQ�'2����\ƥI����9`��d9d� �F�VS=E �bR��*:���������x�-�
Behavioral task
behavioral1
Sample
b6bcc5c08fa6950175bc6429582df2615a46ff3debb771f54f58e97b8e2be250.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b6bcc5c08fa6950175bc6429582df2615a46ff3debb771f54f58e97b8e2be250.exe
Resource
win10v2004-20221111-en
General
-
Target
b6bcc5c08fa6950175bc6429582df2615a46ff3debb771f54f58e97b8e2be250
-
Size
684KB
-
MD5
134553f71f42675e05795d59d574f260
-
SHA1
04c60bf03cda1a9b55a4c094e6c0c5db7b360807
-
SHA256
b6bcc5c08fa6950175bc6429582df2615a46ff3debb771f54f58e97b8e2be250
-
SHA512
90fe80846a7fd0ee1acd84c4cbc1d5b7c65491de6a432f9fe8b5ad5e8356e1dc2bfa85abf107b99348f499054947401e5c0377dcf902bb9ea448428c3154f0d0
-
SSDEEP
12288:vQc/oV/bUxuWGQE1PI9sIcHKZgX2aAp2VZ0OsY3NzYvEznMH02Wguu3:vQHwxuWG7y9sFqKGaAg+OO8nMH06uu3
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
b6bcc5c08fa6950175bc6429582df2615a46ff3debb771f54f58e97b8e2be250.exe windows x86
f17e92d9991907fd3b4c9c51d89cb7a8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_QueryInterface
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 411KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 668KB - Virtual size: 664KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE