r�_���b�g�����=��,N��1O�;�Զ�3�y�·�U��gk��Ԋ»���Nx�Q1�^�M�G_���&{�ҋ�bJu���rk��Z#l����9�[�$JܧǻI�Z�=�ݼt,d*��d��N9\���%Է9�'hr���:�a5�ꐎ@3�C��b�� �7���i��p��S����͛.��s.����g��6��{#:��G��|j�؟��E]�wx!wv��[w�ך�=�;�\��0cΖ�ܬ�*����7�S�ù ��#d��o�<D=�Оx%b��x�#P#�Z�ĥ�8��}��A���)�e10f�cK����ɮ_�I��$��R�\��A���PP����(<9�B-�ը��]�����H�7��;rb��B4�\= �ޱ����7�yH3&i8�`��$d+�"��9�7�Qd�jɣ�eY8W�$�s7bfpkf���orp��z�I:��e2��hO�kA��O\W�ӘGm�H���� 4��N:��(�+���-��kQ?�Xw��F�!���)���W������m7C�O7I������ �z,vXn?���FE:�����1(�Z�ٗ=�r# ��� cLv윯�P(Ӛ8WN�3'L�bVrb״o���Gێ�#�b7y������+�gi�z5�N0����Y��>��i@na7;��J6�����;��z ֿ��Q �ʬ) ��v#so!6�I#�Z}0�)zm?(4�,��p��W�4�A18a^�J�,>�x�&�+,Ng4'��y���d�=��7ϙ��_��̏Oi]�ܵ��b�ա�s@��u\�f4ߪX��o�a`S�j<:�_�.����,�5��d�g��f�q��:>䣳��<5��h3[<ΛB�0_�0D?]��K1֣0����G�c3�dp�^���M���'�?lA� ͭ��f�r��!jC����"�������\/9uͮ��&v.9��FBh�h�����C��Ą�\�'�謃:NJ�|�"����uSt�4^� �AbP�&��LgE�=s������8*ϻ��-����}Ԅ��p���N`�� bIЃX�}E�*r̜3� ~e�m=��I�'�F�t^'��:����5^��]Wɯ:��Ϟ3�����|��:?��$�\���B��A�S<����V�Cy%\�&������'٣^YG��U����$A�:�zJz����c�͜?��-�G5�Z���濻��T���/��A���l�6�Q_9o:V �$`t��I����<�`U�>�U_5���c���wOw��I���:��{�=����\]�k��4�Q�ɯj�4�v�����p�j�y�c^�27 �D�e�՞��_.@G����(��]L����Vuv�}���ѹ7�����x)z����W�^��������wf�, �P����G���qȹ������.N��$�(���Î��Rzy��oG�l�e9���|K��ÐC�i��wL����f!����G���-��u��Btp�*�8��n�3��1�M����FZ�k�|>H��uEC�7��*B;+8o��H�U��z���� �'xg�=� �a�l,�ī��K�����E|2�*���P{���:p=g�#N�H�����(�h�::�u�-Sy���t����/Kr��[z3�0y�k��iʲ���f����]�"�����LcjF�ֆ����Hm(e��C�n7;��A����}I%B� 5����M�����Vŵ���+���Ȉ����^g�oU�g��Z�ڪq���UJȢQ家�Y����#�d�V6�?�?��ӑj�� ��{㧝�f���Y��ĸ2�'�����5È���~�����%@Cݣ㳥�i�����봢+�r{�}�ˡQE�I�y:_:�D��WKR-Qช��E?9�~�Wa_��4���^}3~�Q��XTA-1���8��2���_�՟�K`G0a��;�Җ&�=�M�Px�`���"�J�#��)��k���)���P�] �-2�*�����>�p��Z�ɋ�C�r Q=y��㘱Q�}����lfT��+��j�),h"7�Y�������k/HGc�,I-�x�^�Iɨ�$&?!ł !ԝ3?p�Z;^n?Y̙n.L�����p��2�|��T6���@ @?b��k@V�{H~E�}�����Z���@�ϫ���n�����]i|y��R(O�ŝ�mͨ����R������h�Z�F9-��̩(�yr��בdi˖�ߠ�\��z^,P\�څ^�/F�m��:Y�W�C�@S�qׅ#D��������1� �Wl����?t�fYm,��ż�?L�S�ZF�Ab�F�YJԬ�8���H7����_��F~~��w�g-C��>в�������Y�u�k��)X�xh�{u܉����<՟��J1T�7y�10������6�\�������0�ZP�6Fǻ�p���F�r�Ċ�z�:�p��M�G��ئUτ�s��a�j��uڑ#݆-��[�����O`�8�ĥ5�A�ݱ��Wp�c}Z#<��I��5�B�����b0\{7�BHa��_����D�o�P�A*��ui�a^N0ب*?��I�_�@�?j����[�Q�;:�b,l.P�I�Jk�dd�=fĉ>�;p_k�6����=�威��1��Tz�h��5�SR����y4�)��8�M�T�V�� �s���߳�*e|=��r���9���M؝���@f;��� �Bq��rj99%�x;I��vzaQB�,�N`;���uLط�\�j [ļ���N��@�l1����O�Zz�0���1'���W8�j~ Q�*��A��>%8�/��k��o�DheN)�J�[ʟrm5ܹ��UI�6z��q��� oh���'���&|����������]Zo�J����_L�Rf�Ԍ���/���Y�^)�e�yѬ���g����l�9��8�nU0���n�y�F�D�Q���%����fc2 �"�z�����8f|���%��|'ܜ~�"ߝWlm/�*��w�IC���3 �{
Behavioral task
behavioral1
Sample
2ee3047b0d64e5882675003c43658b9b9e784ecd2a8aa571ce112f616ee04d4d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2ee3047b0d64e5882675003c43658b9b9e784ecd2a8aa571ce112f616ee04d4d.exe
Resource
win10v2004-20221111-en
General
-
Target
2ee3047b0d64e5882675003c43658b9b9e784ecd2a8aa571ce112f616ee04d4d
-
Size
620KB
-
MD5
4c390acd9eb1f3272f975e32a3941120
-
SHA1
3bf2972b4ebe70632aac5a8dc79fd075a586a712
-
SHA256
2ee3047b0d64e5882675003c43658b9b9e784ecd2a8aa571ce112f616ee04d4d
-
SHA512
ffafb4822a327130ed86d3e71d13d5fcb808b94f27af76be5b140f36d8c865a4fbffd25f574939cd138406efbc739b4325f7d7368fdd5bc0b568392ffb008b44
-
SSDEEP
12288:fGcR240yhtN+EYXs8N45q9Lfm0egkfsxV0rTuaxuObDHHOPF3J:ecc40WtN5ePN45q9LxIsxOTuaEGuF
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
2ee3047b0d64e5882675003c43658b9b9e784ecd2a8aa571ce112f616ee04d4d.exe windows x86
59037b7c010c360a4862d476cedcd682
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord685
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 604KB - Virtual size: 603KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE