�������|?��].P���ǔ��ѵ1;9}�D�q:�jJp$�y�H�y~c�T=��U��z�WO��(#�NK���B�Pn�����M�{q�l<���i�n5�v��E�pĻ@����b�oxh�L�}=�ݱ]s5����]guU\N��(�v��= ���s^9��I!��� �����%�����H*��sN� ��0���l�۩���}j!8��*�{�y���߁�^�k��l-�h�JoQ3���7�d{L�d6�>MC)������+SE>q@Ll9�b[�yj8� 4b"2���}a ��⢦� ~�o��c�o��tew3.H��Z3���'<�z�$�F��NO��ݛk՝Eq��Lׇ���Y�����R��������3 s+`���]�i�I�٥��X��]�#��c��3��x�2��3����`�$[��|�B��p�9ߔ~�g�����5���V����s>�$�n��c8>��M��ʱ����y�j]��t�|z7���f����U�q8���DL���k�:�r���x]9O����ғ>�ܥ�=��� XR5&'�f�=�UJ����k�d����+�}�-Pu�[*,��Bd��/�FLĈ�B�ȴ�ypzAkT��$�`��:4����diX���;�Ld�� D;��t��tmS�zݰ�&2T�3bt���s��n�](_պ*�7�z23 ^�E�c�k� ��VB!v���� +^}���;���)��Hn4�~b�dɑk=r|���)T)�)�#��S�Q����`��.�Q���jB'M�c���������ǃ���?�O$*�LH1�R��,���ߌr�4\���_�`�"i�E�9�;�`���>$�X⻛�|y�z�li��o��#�PQQ,�L��|>� ��P�H]qZ����qu\�n�}���CHD��I��s�0������k��pB��dn ��&��� ��*��6g����L6h�������� � �X6��j�[��a�`��8�\J*�>�c <�0�M�&�Nq���/@�+�Ӥ��]k�NT�=�}��p�y����rD�%&R��D�q��D���sI�҉0bmt4��!2e�I$�Zg�[�\�W�����mٸ�3����i̐�҉ަ�ʲ��D����?|s;"����y�+�%x|_��}��[\=X���k�o�WO.���HDZ�w�xu�|��zV�jjl�1/藭�1��4'��z���* �S�:�Z�LȄ�������D#�)�0b/�$����W�6��8���r͒�t�6�ʋQS�d����)?RY�N?WN�������0���&�=�����T�o:��f~����c���m�/��4�����2V���ju1�Yq%�=�FjP�11�N��C���v 1����v�b�I!w�����䣄���5P�2:��ځ ;�t�.`�r,�G�3xsa V7k�����H���V�+g��f�WD!��D������h�wG.F{��w�1`� ���\Ov:�L�ð+��}����;ܛg�Wm��z���>��i#���8\D ��+��1���u����o�8�J���uևA�m�p�<�|�,�AB@�'���O4��Z�F��S�aY6����ڰ�����_�8�P(�J���5X㞵f�ԙe2���Kqu�:�A�r�W�X�?_�;�O�C�Q�����D���{S{X�}.�` nr�6ms��rw�J�����ٓj��o���?�ʌO�L��zl|jWeg)c۰�S��%4�G����[zL��&� ��;a~�U�[���.DlK��k>�ՎpmA*�L3��{�uW�� ���\��������]�Ƙ (��z|�a�ML�~�����Z��?�.[O�K�`F�W##�vq��z�<�̨h��e?����EE`��h��x��˱5正n�<R l��Ŋ�E~(��Ե&xT�N�5�U�e浲�Zz#�o����ρ�'x%aI�{�laD� ���H����i+��.Y�LqH���4rp�VI� �Y�����K�XzN#��7����(� '!�4��8�o��ʾ#�� W��FH�dLl�ŤH9b}u�;� ���% `����2I_)��^�"!S�X�I ���U��]5H��N��T�J��-x e�\̎~TQ���f�*�����ݏGɑ��v������]Y���m{w�VJ}(�N���*�������KH��=7����ጐ�iam�m�U�� �W��,� �j��5�p���n~�i��v�>���(��9�~!9_m3Wӂ��.�랓�L��ȞՏ���0{%�h$��_ΉH����r/��S����k?^����p�C|�X����C�G�"��U�jٱ��l ��䖨M���T�oj��M���W`��~lEMaw��� ֑ ��R+��8�g�)k7��;��$_o��uĕ"�z��dL��'��⼆}�p��6�>}�)�f�kz}:�0b�W�O�MHL�}�2���wS��/�d6M�:U�v�g\�gNZz�l�>?��� ��4���Դ�*r�<���Ȩ��р���a =~<YUf� ��<���M��u���$8, ��}v�YL�Jvu�-Ym[}��|a�^�3��)wW�l��H�������Pp�5�5��(��?�l��Cw�� >��R"�K�sI�*y���{#4�`R.>]�W�y�B莬@�0N4�*]�bM�e�&��\O4�GT�U����V�]�6���m�zK��yZC+Ӳ�Sx�H+�Mv~����O�sf.��X��]䢣�1���ߖ^�\�~����=O�.PN�x�!'���lv�<(Ǐ�� ٧��:B50�s¯�C�ڝ}�{��գ��c E�f�.���({���P��_���b�F�z+�@.� 6t�(}{��n���X<ߌ�AD��ZUgR�b1��Qy�p�ξje� 2{P�����(U�1��v!�D>0���z��Ŀ6״�����;D[K �=w�u$m�$�n���cΊ��s�B8���F_��yZ�=O̪)�,N�˟��V��5�� $F��m��G~%�ymH%e�<��[�"��tI�������qѾ[~��� �N
Behavioral task
behavioral1
Sample
27bbc04ee4469191f0d4c5b2f8a08ddfe7c315798655447695037dd82596ba4d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
27bbc04ee4469191f0d4c5b2f8a08ddfe7c315798655447695037dd82596ba4d.exe
Resource
win10v2004-20221111-en
General
-
Target
27bbc04ee4469191f0d4c5b2f8a08ddfe7c315798655447695037dd82596ba4d
-
Size
224KB
-
MD5
0dfd14effc6a6764e2c2147907719d1d
-
SHA1
784d582d7799229ee2de7e1b1c72a4096e9d2b0d
-
SHA256
27bbc04ee4469191f0d4c5b2f8a08ddfe7c315798655447695037dd82596ba4d
-
SHA512
6691deed6e36d6c6c8e3bf6122993a30e88dac4b7618ae655826d694d39b693a9776e8308361484482167c5d910acad1e1c98d7a36295b0d34041a7a28686ae1
-
SSDEEP
6144:8VzxSazpJkiu/im+yDTDjXOQvjEq6EyA4:8VzXp9Pyzrv8A4
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
27bbc04ee4469191f0d4c5b2f8a08ddfe7c315798655447695037dd82596ba4d.exe windows x86
e535007125c2a23a9c24542d8bff80b6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
comdlg32
GetOpenFileNameA
advapi32
RegCloseKey
ch341dll
CH341SetStream
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE