�<����$�{U/F�]'����!;�]P��:H��:Ds�0O��`�72s8�N.(sy�{�,fe��pBo/�lڔ�v������~�~W��M%������)n;���$b��/:�\��we��`G�o�]��w�����O-��X܋uYlH���:N��B���KY�C��-LX�e^A�sPK����W ��rQ�n������h1�����!�?�~���N#K�,����&�����#�i��\0�=wY^��w�"Ң��r�ya-j�Њ��o���IK�g�H�M��:�H,W�Ŭ���U��������Ҷ��^���9���y����d�^4-6�:��x�gD� ��xJ%�Reùrb�f����࿊��(D��4�#u�Q5�2�2���8�h�F`����U��qi�Yv�����N#�$��4;c����RIJ��XL���ܽ�V��@a`�P:|[���S;"PsB���1�^ \B�T�ic[C��ώ�u+�r�#�e�7���jW���˸����F���J�*�����0�]F�k���c��@h!�θ��0�!(2��Bp»E���������gE����bp"��e�7�6 �M�9�֭-�t��g��H��M��h%�$T�CR��-�y��8��W7\.�w��E<��ˋ1�y*�jH�[dA�����L5/yu�&3�A�����1#��aբ��'�0�Y�4���j5��o<�sZ5z&�����n���^}'c�T�& K~}d�J���f�Z8e K�Ø�2K���N�mT�j_��|��O�;�2��x�����03����P��-\XF���a�p�������̾6��π�j5��Ă���e%��@��U���� ����Xk���3�%C���+�<����d�-���4x�������*U��.��}��Ԓ��T=��F��5���˰��]؇�R�Eg�)��XЦ*���������������͆9�� H�g#ѫ�d��K��-�6�u�օ��t'}�V=�Q����L���1�����숬��5�@{p��rÿ��8� ]��L=$!^�D$P��No����dl1["�/�C�IόN ��R��o�A8�)��?�3y�)C�ӵ)C�lğ�<��]�q ��,2^͙�P1���ڎ����0S�>v�̫����`������ˁ> �}�����9_K�$MHqX+""�J��PI."'h�M���*�����fKXJm%hjP����k�d*�m)�/^`���<��������h�ÙS$k���ڍ��ۣp��B��% ;��[�����x�_�C%aƶjZ$�E��K�N��W�� �=d���5ow�E��O�l;"�����)��D�s�/��w��i��ij�y3���3�A�n�T�m>U�6�Q�)��r���4������r荓k8LיȚ"������ЖJF"�f���X�)e��#��B�<������H�o)1�v�vN�KC��]I9J���$���']���v���p��ζ\F�I��70h)�Y��,��6_����i��f�;����Z5Z�l�\;!�r�T��#x��Ɖ��g<�^8�����쑱�I%\_�}���7I#���&�L,�B�O����8�}zq�����c�lKMq�b���a)1�E妺�~��q�:���z���u�-C��%�yº���1T)�J]F�e�����v�24��T�fp9YOsұ7c��ҕ�r���kR9�sb^-��Q���'⼀���m!��+�A4�ҳ v�$��m�)�I8��N���+����#�� ���L Ѝ�������h�+@*���h��/�'�����;vk;�ǐ���E�ZA���8����Lt�O�n�I�����Y��:��V��)��ʢ����Sv��\9[��O�9w&��u��$�s���|�>�$�:K���>X\3̗a��ҨW��{2�Of�<��/*��S������u`���8c��80���Bxc��F�g�/�8��b3�EP��ۦK+ZԎ� �����U��+kG����_,|L�e����5P9����Pq��Rq�ð��)����Fƒ���3َ^E~���%a��:��VA�zD*�L(�ښ'IUb��講�UmBb�rp6�0V�fFi���KM궡wVGGY_v�8� �d�n��������r@�=����O�����ٔc� �S�;|�(�ݳx�Y����c��x"�v&��J ��w=u���6F��q��+�ݹ�d�OŶ`��(;�go(D����K�[�yD�ƒ���G�Lw��*�������p�bٌr0�p2Jݦ*x��ϱ�)��@ۣ��v�5��`7zQʮ�||v�=F ��i��M�ȷx�����qy � �5�a�t'�~X�~Y�7&���? ��6���[��"a)�C7�-���:�g'Ƶ>�6PT��1 �&�vq-�_���2���k�G��2�d��,W����!�Z�yʡlpf��鯣�3};�V��uO��"��ۣ��^mУ�>E�xSS��$��/��N��1�\�4Y�y��eM�ǁ8�/e����-.2�a�z��}�6�?��M�8���3]^ե `:@�_R� �[��tW��2�"BM87�T.�n�yr���Ⱦ �蝌i)i ]z1`mj�3�ᥛ\���N$���:vL/����7��p�][����ꍑdH %�o��y xi��E̚ڙ6D\`�}�'�6�l,ϟG� ��A)ʇ˿�)����0�1�o.w�D�����������l�� ���2 �4&̜��%��N��#��O�ٷ������e{���̢xt�M�0�e=m��"���S��_~��"����t�DO�ݰ�]��g_��ej@=���� ��x�-����Fp!�Vl��31������|,��1�u�@Rfa��ŕ ��+�9�|�WZ�o�(:�� ����[4��cW�*����$��e`�(�u���y6=0ZM��7��3e���Hs�B��l�����7t6�V%�7j�i�#Xi���fg�4H�j�#����8�|FYp|w�F��(}Ĭ �������Ţ��;J����&8�ljn�ZY���gU�i$
Behavioral task
behavioral1
Sample
8801deb3396cbf5c676b16d63ecd0238c5bf1648f1e14c9f222df2554955180d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8801deb3396cbf5c676b16d63ecd0238c5bf1648f1e14c9f222df2554955180d.exe
Resource
win10v2004-20220812-en
General
-
Target
8801deb3396cbf5c676b16d63ecd0238c5bf1648f1e14c9f222df2554955180d
-
Size
1.1MB
-
MD5
829995441425b5143510f1cf02a41d04
-
SHA1
c9c82e625fa3933ab9046913536e72d48d9929d3
-
SHA256
8801deb3396cbf5c676b16d63ecd0238c5bf1648f1e14c9f222df2554955180d
-
SHA512
671c10c064a3e38ee74e12b27cb29c85f1640629338f7f28c1717ddbd6c244a0104be69f4c0f90a6746a294555233b8590029f8021fb1a2d78039360587839b3
-
SSDEEP
24576:3Jj9iBv0OTDxz5t+hKzpMdwH48NbyDdyJLZX1:3riBRfxz58Q0dGGidX
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
8801deb3396cbf5c676b16d63ecd0238c5bf1648f1e14c9f222df2554955180d.exe windows x86
66a4abb5b3a8a4e08d19dd79d7e51b7a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCursor
gdi32
SetPolyFillMode
winmm
waveOutClose
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ord17
ws2_32
accept
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 430KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 828KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ