-�'?��n*l>"ߢ+�[�G�d�άw�O��,�i��8� ������p�x�q��=R�l�<�жtfĪ��ԁ.�?�C������O�V&~2t[�D�a^���a��%^��s����ѫ���'�����[f��C�G���v��5�Θ�a 1X�κ�BS(!�=M��,M�736> �j�b�'�aCI��ގ����� �����Q�C�Ѻ{���Y7+:E��m�Թظ�ZR��쭱�����_�=.��m� �"4�f� �\�jT�&�t���Zԁ��6������CJ_&�j�$!��'Jpy}��}��f��p���H�! zI�8()�[";/�R�(�+=*�+�B�7,D�$)�4�.�t��B�.b�i'��������6Iy�c���ҨǬp͢ro������~�V!�u��3Y��@J����YS27��*������|����B�D�3���aK��b ��z��E����V�-�K(���q[���L���P'N@a�RY_ �ă���)brdQ��h� �Km��֗`�!H�nB{�=W�k�_�1��C�K�7w�闑�Վ�i�;b�';�ڎ����X��Κ�U-i/Y�5n�t��5�Hxn�sH���';��)�LJ�I��v��2O���q�?�_w Aud#����[bo��S_�j��<ݷ���]|�.p�:�1sƩ.Q|����|E�B`�m��61 t��}p{`�LgZ&��g�H�%kwB���I�͒��*�E������P�s�O5��<`�ּM���u9W9�gBg#���zX���^���$i�<��PWyW��4��k�Sr��@#�pia��)~�:��G5L=W�yk��ԛ-[[��X)l�[F�X�R��} y;���¡ٝ�6���K���?U��z�m���Vud���P�J��/�϶��#���]1⏽3*ɪ�'.inK�ԣl�H�&驑+���^���-]��j�2R��6�9�`��x��s�S` �I)۽eMWC��KI��pxe���T��2��{�E��Z����Đ���͵&_���y����R��>/AU���,z��t���RC5��d���4�Q6����i����C���ГԎ��ueF��m���%�`FM�ϻ`Y̭Z���`�Db���S|(z����J���Mײ���4o�g�!��-�u��ٲAD��������h*�fv9�0 �C���%y����p}�')��k�-�J��).z�yH�u[5��͟�\eF�����]��������i/N'>�����@Hq�I�nC%$G�w�J����_�J2p @h�(=vc�� �2�0�����$}z�;�14��_�� ��\���D��C|k$;Qerke^�`�۠Z�� �k�^�R��1_�W��qh��Uw��q���o��'&��bw���"��f�̵+���[d��+|$<�b.\F�G5�i�@��U���&����Z�9�n��WZ���L���J�@�fw��2B��QOU<p� �C.��K�\n*ҨٕԹ�b��ݍf����D�����P���`���7�R�V�&.�ې!f�Y0�Mpr�f6����F��<���� �_��.�S�OK�V��\6��{� ��ԣXO2T@�;�[D��_���`[�/I�Lm�- ���WS��q0��)]���!�Y��暦��d�4m$ү����i�S��l"��c�ooŷr}hxTG��:X�56Ԟґbp��~oh*o���Tp�����S=x��\�r|�5���[[E>�A�?3�e�kZ4L��d0� ���~�Z��}�@4��/-J�f��E���m�������4RN�}`C�&�yޠ� ]�'�W��>w��D�Z��^���m�^sՅj"���4�j�z�6r#�6���g�;����r�͡=+��?����V2M(��hTe)P5T�������w;�|���:a���~pT���]@S0}k�Y{h����-������z2�_��#o=��솞q O}u�;+6�'������6�*���y�5E��>Z��Ƌ����%�Df(�$�W�٪3yw��/�������Z�A�-&�#�r��A��B[�}峧�$�v�V�c%D�* ��6����?���|ꦾ��[ ǡ4,E+-�o���U�q�b@C(�[�,�\� �c% �h�y�v8�@P ~�#f)ՠ�A�:���m��#K=��+|�1DyB6ޑ'�쩆g�Á�+�s^&AM��}��=cR �h?p@ؤQ���BO�-��T<��!j-��dh�� �l������x�X�h����N@+�j�c�Q����)���������[ݻ8.�a{�/������=���G�v��jF]g���}�\8}�)���Vܗí�&�3�� ��[�2`����p���A��ME��}���1�g�팯0����P��G�;3����uZہ`3D3�-���Xz.<':d�����C�:M��@*R�m/�B��6RL�Ô�-|rX�{<�-�q��Ū!�6�T����qt�:a,N�P�܃6�~^LG`/Ʌ�������7��la�� ��� ���g쩸��D`��*���P���qZ�q��^�~��e��t! D�Β�R���Ԥ_�#R�M(���tz�n>��䕨�:0 ۵�D�;���C��h �������Rso���(����}"�>�=~%�I*)��6�Z]�c5e�XU�͐6ngҙ��&�H�I��gZ�%���)"m����hKX��^��9�Fb8рrt9��Xsy�-�gܰ%o��`5�FRV�;�(ш�$+���9�R#�MW�B/G���e�E���U�1m6�'��DIA�����mL�� �P:��ß}�`�]�Z�&g �Z�W����v3z)�.9�Y�b ��)j��>W�$�v��S�����i���+�ʨ�y����pȚ0�q�ȟ=<*E/��S��O�2v�h��c���9��ú�V����"�-G@��e�2C�\�·1�!K5��bؖ����*�����"fN*yR)Z� ��ʚ�Jp�Y�Է��K�KG�T��4����-��(�QQ � �|��8�>N�Ly���_
Behavioral task
behavioral1
Sample
14a20798118b4c89dc950cbb2b6cc35379449cce7e1f06e1e34106b549fcc51b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
14a20798118b4c89dc950cbb2b6cc35379449cce7e1f06e1e34106b549fcc51b.exe
Resource
win10v2004-20220812-en
General
-
Target
14a20798118b4c89dc950cbb2b6cc35379449cce7e1f06e1e34106b549fcc51b
-
Size
1.4MB
-
MD5
56bd1c5228b2fb10916b230726d4f8e9
-
SHA1
59c5197f8b75c76dcedb1e4b8aa63b6afb034faa
-
SHA256
14a20798118b4c89dc950cbb2b6cc35379449cce7e1f06e1e34106b549fcc51b
-
SHA512
b5108a9103afd04780969de0d672ec73e6f9ea638ad920104ecad3e5ca390d3bcac7be283750d4aa1a5e377fed52b4e0f433917e5b7aefb9d2022d7a812609af
-
SSDEEP
24576:T9SDxKYqm/q8hF2wRG9DrfVSlqkNrm9jT1ZNdjOyxdUnvVtehIkQKFmgaCF9QPy8:T9SXj/9h4U8f7/ZNIvmOQIgXF9Ux
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
14a20798118b4c89dc950cbb2b6cc35379449cce7e1f06e1e34106b549fcc51b.exe windows x86
3077723d531bdee7e4dbc5972274653c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutReset
ws2_32
accept
kernel32
GetModuleHandleA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextLengthA
gdi32
GetCurrentObject
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
SafeArrayPutElement
comctl32
ord17
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 832KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 845KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ