o?&R }���@֙1m��At���Qɕ`�7�2�pN�� ��9����06�-F'!q��N�"+��z��������U�l�0&$��q)�MW�R�� L���Z�.^9�����'r��Y�u�7�%3���]��:.I�����R��Yi>N��~���xqtP)�P��M�h|��^n}ו�A�R7���{�]�K���z��k�+������^죘R�<,�eY�-3yJ�xIX��y�jk�, �q��C_�quN�f4�����[ΔE��j���Q�bF;d��tk���M�ԋ""Q q�;{�{K������/��h�f�]/0���u��Y%5�h�w ��g�&+�?��ʑ�H�%��7;�U�l��l���Y\��;i��?qq�q��=Q�������?��{���6:x_e����3���c�� �(.�����ƅ���^��x7>�c�: �(D��l�F?0� �K�E2�W��K��k鴽bN�g@s��yK��]Db&��7�}���x~���H��S7�pU�bA��XS��ͽ�{8ndK9�iy�ώ��tS��� U��6KZ����t�t��n��>JJ8�?���徶�,�N�kq%}�x��`�;�"(����C/�S�m�:H<M)I���ī9#<Xv��c`�9�M h3adL���{b*���pl��j��y���]�����K�ʂ� q`?ً�)�Ar�m�4�P��t݈$��ÿ�ZW\�ȟ� @'Ys��enf��+Q��5���FO��lǯ֜,�P%u�H�{yW�������BPqx_�9<��G\��Z5���[^�~-��_�b��o�]��a���bDj��^� �n٤\:�����h������ ���ˇ��k�m9���a�O��8���&e3�#?������lݎS�S_�F�=?O��D0QS`QL���>;\��A������2�lLT{�Ώ��������gz�?s?%��Nj��5ԝ�3Ɏ%b��w��|6l����h��7/7�'�uɋW�艰\�q��T�Y9�j;�A���������Ì�8�&�1;�>p`��S���FX��Y�A�%�� ��>��J�NHY�ޓH/:ȃ�h vh ��L�K����4���1�Wf��H����f@+�ؕ� $�t�=�ιB.��̊Ø��� �jk��*Yt��1�5WV�]5l��(n���ݡ�DMp� vwȂ���-��}a!y�{Tpg�9�ڮh;f��g��������- ���qN�Ex�6��60�F%ܾ>5g��������x�X͚H86�1�����WtBU�W( �"�^t��!{U絞�9�{�.({��7>[�����S5ٌ��Q1,8�(q��q4c�n�6E��_���u4K�;��D�Lw���H��$)g$T���E��ע#���r�X���+���e��Rae�|�̏獷�f�N����x��$�������[C��${� Le�3:��P^B�sl1f���Ú�������F*�_p�� �t������our�/�|�H�q�g��d���)�-��2m��$>���R���"7��:#���� ;n$-h��}+���m�힞v��Ň���x[ Hw�jD�R�XG0"�kFSAG��V/�v�bh���-Ws�g�zK$�ݭ��zR�s<ӵR�������=pB��C���Y�L n���\��Sַ�/2#_�5f.�?B�ϟD���=Lh&%��on�`���r�rҜ*�!7�$^mh����O7-��L�s��u]�� ��W�C���#F�������?�=������:����1Sꫲ�~ ��X�� #�%���m�������̷ԗ<���Β� �i�&��\��T�����4����L"�/S8iJ����P�+\�{q���zN��L��ËI��O�v#N�r9/�#���W�\�D��>���wW��&�J�==>Mܬ7(H9�V0d�C��,?J�����f4�c�2�ٝp& tQC��gI�+�d���ʖYѫ/ o�C��"gXH�9�+����n�$��V|��ά��&./y=�@ނ`к��`�jmef���\ "�v�sqBR��T|<�)������ l��q�Z�9�B� |-���0�Ԫw.����&������(�C���(~W��E"�����(�Ck�R �*B7�W�|���vn���E5b�M�at\!0�eS�h/=8l��=A%@�i1i�y�]�f�x,��P��}�v�\����;��7��)�0���VH �$&�3"G�{9:ܪ452���,��3�r%e��A��,����1�M��A�XF�SsV����M�iF��O-w~�t�4�.���)��y�����%����_=%f�ǩ�r�H3��'�2D�ؕ9;Wƥ <@U�U2�viT��O�@_�4_D�x�|��"�� c��v�'B�i��L������Taa.}�?D�- �X�|���E�Kǀ��Q��쑩B&�K�K,?9 �%�E��|�Ɲ��w�"�?)(O�G��(l��/�3sB��0������=�Y�8�v�g��X��Fs��bsc��O2W�A>6-2e-�9|C��>�:\������`>*_�����-g|����-S�vB�)9�����H%r����[��g芌����@�(1�H Dρ����(�jњL�1Uq�!��ZR}R>�CT���a����j�ɣ�A�s���f���t@G�t2ӇC-;<�qO9hB���dcn|�Y=i��Ww�+æTF�SӔ�U��������PǦ^{��Ɣ#i�!մ���*������CK�ՁIn�<X�K�07�IH�:� k�s�zh�}�TR��?����k�m�Ǖ�q��ж��~�LN���W����љ�Z�z��X'��m�̀��&�2���a_+W�# �R�����.���0� ��V���-��e�� ��p)'���v,�_Q6�b��7K@O� -�]S�rB��ˇ�%��>���4��vD�Np*��_%v���7;`�,F�h���0ʖ<���μ�D�?���!�L��[�Y����^��i
Behavioral task
behavioral1
Sample
cef5262dc8dcc89dd533570752c5bf8aac9034764165d406824b0862740508e1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cef5262dc8dcc89dd533570752c5bf8aac9034764165d406824b0862740508e1.exe
Resource
win10v2004-20220812-en
General
-
Target
cef5262dc8dcc89dd533570752c5bf8aac9034764165d406824b0862740508e1
-
Size
672KB
-
MD5
c57e9ccfb91800d186400d1795fb29aa
-
SHA1
8d4907ef23fea782b881f2a5053976cff743106f
-
SHA256
cef5262dc8dcc89dd533570752c5bf8aac9034764165d406824b0862740508e1
-
SHA512
28a4cd01204b08a80defa097f54f55e1bd71000b7f35a3c71d91ec8e19ef3155730c2a327ac294deed72f0a9f7f4118e8143caaf11b0a86e381866c915e9cc39
-
SSDEEP
12288:yq1S48WcUgiB1/KSlRMochbTa8HyWLdZagE6awFe1iQBP7obiNmp57RNIb:51cU5/KSlR3chbTHXhZ6wFe1XBPiis/
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
cef5262dc8dcc89dd533570752c5bf8aac9034764165d406824b0862740508e1.exe windows x86
f4887909c79cc868495bb4eefde7899f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_CIatan
kernel32
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 605KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 644KB - Virtual size: 643KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ