�Hlp&��� Rg��ܴ�'Xn� ZhJX����{E�����Jw��R��:ύ�=��Z����X.�ӽl���^(��f����m�������f��k�Yw�ݪv�o�Sl�|��i3DD��8���������dQ�|&WY�]Ѭl��O�LƌL]��,L�����@ڌ�������$s�f����⻪A�Ƙ"�,���ڸ]�8�,(�cL�$��O�� �4d�O@ri�nd��!���(���?B ��,Eו�_�~���qj|��n���5x�\�������|�Z�t����ڮ�8w�ݤ� `<Hy�&<�M �>G�����*�%���k���!����1�m�qз6�u0XfQ��c�$p�d���k�څ��� �q&@�I��p+JAn��틶m�w'��g���Å/@v�R/�����Z��s���&P���B+�j�2�+�����Y����f�^(+f=�$N���F _UG�!i>V�E�\L�;�n���2�sh3T�T�l�G����nB&�yY`2���m4T+D];S�������9�l7ބ�����X��sMZ �&ٛ�`>uI�1�'QssBV��U5��%W��T�Ls�v��I�-�p$Kh�R�'yVKt�Yy�� }���$"e�m?�~�>j ���:� L���[�ah��=8�d�yH-'G|Acɒ��-�ZQ6J�Z�S�Lח%x TB��g���F��D.����d�� �L��jd�|?����bA�Vʖ������A�}�N6��y��k"4螸]`3R ���䛔7��R�?��a��ฏ� +�͔e8�<*��N0��y[D���+��$��C��X&\���F���_�,@���1^�� L�8n���:>f�7�l>x�ܧ>�q��p)*�_�`ի�����K�g�{S�s^�Qv�^�-C������X "�2k��9�b��� ��u�n�X�+��믬���Q=n�.]�(Ǒ=4�3Z8kq�/ ����zB+J��Ua�H/�dʝ4��;��T��0��F���A���� �M�`s}h֗�5�P�Z��Z>��#pK����S��Ͽka�eK;����R=�2Z��Ι�����D�baF��t4m�+nVf����z�w*��l5Җ/���� ���1�u����DM�D��@��J\�v�zn�UY�nB.������,�V�� �aKo��_�HJ�:�Y"����Ők���tNнE��c2���� �T0`�w7&���)Nb��H�Hk�c|�dE~�CB�r��i�U&�D�(�������Pa���ԭ��+�T�R�@e��K�s�G����&!NK>���� PotQ��C5w"S�������8��7��J&�\6�h7R���"�����xZZz�!]��,����ml⡡�rJ�� d�=-7al�Q��#x"���aGO�P�_� WR���r]1N�m��Nw@����"�|M�+���0A��4��$-SÜ��R��v�X<���+�}�C�{�F�.�����ī�@�8ڈ·�剨և�j�7�i��"fgnhm"����;3 �d���ӭ�/�[�L2��9��W|A9lkf�]7�����B͈O�k�2|�� N6!pțJ�N�&���xD��3����fɽ����,_-�}E�3g����r�:e�UEv5��*}N Œl ��%ɠ ���w�Yz�"�H��|s�1������ȉ�ɸ���5���y������1q��l�����h_-�yA�$��v��聫 �T��$�_�$�� a6}�Ғ���Ė�%f��E�h=+j=�7T�)!l�kH�dw�㶢@b��0���ހ3��Zn�W\��.�����Gǔu�Fd�C��Z���8ǔԐ�t��=ߦuK���!��(�}L�֮ � _�����NN������Q��R�J/e �yy�m�Z���E@�ŋ������)�&b���ĺ��O0v@�:�L�����!v$6a��n��p���Y�����A&/������}b�R�y4vYX����� ��R���5�|E}>�\:��X�&�ť�X+�{�Z��5�+�����De^;���+�������6�zgۧ���)~)�9).R������c���km�PiЭܹEv��x�!=�'흛c���}��87�]R�����}��8z�U�Q��T�6�aT0��Z��W�Ks���5r!xu�M�3���,�EZ7cԱ���F_����D:"���\2´�oۛ]A6^[n��5��;Va�����p��o0��{��e:}��7-��.�"y}^�r'���P����ָ�M�����n>��0�2���ڮ���<b�P��A},�-�3�U�J^�;�+Hp.�i�m���Q.�?���g�c� ����T ѓ�(�y���6G��ϾGs�}%�'Jl�8��:A-"9L�m߈ :�y�G`��G�����v.��a�Qi/1�?ż ���և(�E����b�Oє�Ͱŷ��vJ�����~ݹ�i���v���GMI4S��y$���f�3ڞ��l�n���bQ��9ZN�rQ��ٍ\ӵ��c"_`ȼVD��U{��Q;X��L�t��^O���8���>r��nN����:˯'Ƴ;"��P(0k������8n�H�g��/�{" �����]�p�h���J�a�Y�P�p�Fo^����s������d|;7YJac�x�]r�3> b����r�E�[�Bo��Jț�P7��@6����>T-�q:d�lड़%~nV{?�-��]}i��t�4q��l�I�xr�����nS��`v5#Wm>��+����/�H!箐�n�{[s���8�e�i�Q��Cp�k§D@�T_2,Q��;��>1Z��ay����??����!}�y�:,e\1��@�� s�}5]�2��4&Kj2;�,U=ˤ��I��u�E�)��\���#߽�h��o�&=e� ��hXg���)�2��غ8o���o�Px�CV������D)�K����2�����.��/�Bfo"q2��ɘn<�w�S������
Behavioral task
behavioral1
Sample
b20330ff27253eb20c359e949e390d5de4135295405ff9fb8729c4fd13e24c10.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b20330ff27253eb20c359e949e390d5de4135295405ff9fb8729c4fd13e24c10.exe
Resource
win10v2004-20220812-en
General
-
Target
b20330ff27253eb20c359e949e390d5de4135295405ff9fb8729c4fd13e24c10
-
Size
529KB
-
MD5
19b4f1e96f23066feac3455483c95ef9
-
SHA1
3ce1247f65aa83f61e8d5712acab463a8e7bb8fa
-
SHA256
b20330ff27253eb20c359e949e390d5de4135295405ff9fb8729c4fd13e24c10
-
SHA512
b16f599fa0a2dee5e28ee24eb3d77f9319c0eb00371218ef4f5f9388f5166694dc8e5439e5811513dabca698629f7577f00bac97f0bef893bda380fdff0ca23d
-
SSDEEP
12288:xEPdyEjsBK1UtRniaFFaMtuj9MIqEzMXmB96xnDj:yjsBK1SPAj7qEE9
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
b20330ff27253eb20c359e949e390d5de4135295405ff9fb8729c4fd13e24c10.exe windows x86
96fd72c2259536ca37c4a1547e53a3b2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetWindowLongA
gdi32
GetStockObject
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionA
oledlg
ord8
ole32
StgCreateDocfileOnILockBytes
oleaut32
VariantTimeToSystemTime
ws2_32
closesocket
Exports
Exports
Sections
.text Size: - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 290KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 501KB - Virtual size: 501KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ