����Z�T���j���x�����c�f����_���,^I��Z�C1;Hw�R�k��r�x�����_nY'9c�lfD�?�kY��Wp�%8.(�j������pxeʲ$�l�B��iJ�=@G��H��Bƛ�������0���.�.sO�m4��y��l9>;g�(^yέ@v�:u4�pl��a�9�*�ѩ������B%QGo��T��¶G��|O�`5?�N8QB7�t���� D�R�9F�e|o�J��Fzi�Rk �2VS#l3�k�cƠ0���a{w�n��ז���<���mC��6�8�J`����D�b�jd�i[�"� �]��D����6� ���������ѯ�>�t��әo���:3���9�7%2p�� �k{��!"�+DP~>}p�UI�T�����sD⩵�QE7�v�w�"hU��Y.���8���,4�)�Yu���XZ�lNC��R�9�c�A�ni�]���R�7�Qd}_ޘ�� �>�=G�h2��3Յ�lY���{n3Τ��?h3,�M`��<��H2v(9�|$���^����yhDo@�䳗�jy�Z�"n�Qz�8]�o��b�bM�߬�B%����ϡ]o)���q7��*���~k�T�(� ��r�k3�t�a��L�~�8�V+�,���䗳�Ğ,{{]�e�J�V�&�K�|��՚ѡP�(%��l����l�1�О��~��t��>-/���R�f��� ��h\U.�3CA�{�i�df���Ǡ2�5���]��i��U�7���N�}ȺO�75Û}j�#� ;:����.M�ی�E]�T��'�jC�ѹ�(K?�աQ�a�C0k��g p@�Ed�P�Yz�p�������nU�\�����D��$7��L4��H���2r<�0,dM�9������ e���!c� �6M� DU�ZsUBA|���3q���~����j��k4!*��� �)g3��)�:]�H�-](y������cຒ�?h�L�)/L&�I0��20��2�{�J�,%�fD� 3���u IݱjA�&�\�U���~���m���]#`4���a�"/�vZ������|ޗ�`Fwl�Ψ�8�B �s���wx+�ϕ���&����n�����r]|�����Y(�2"=���s����L�6͔���`�]�Y?����k��6�f�Fz_C`���8����%�����w7�[[Ae��������#ׄ�����u�!�oX�M�x�>9�����~��S�,g1W�\���dڵ�̸�bT�m;�� �:]��$A.H$`H���y�ܬx��������Y�����Y�>�D�L����0d��X�b@��S0�2�-M C�����!EEO<�2gڅˈ ��LQ�*�2y}@hI��I�Ϧl�+�>Ai��~7Z��m����ЬI�q_�m`U&"��̑֝�������aA��vt�� ܪ�'XH��kb��*��HL�d͑wh�M��M��C�pv煳讉��.P{_�Yt��؆��~�t�w���n��Z�KjM��h��D���r�a�Ͽ٠#�6���t�ȨO�4kr�6&�]� ��94��g�N�s���vG��Um��U����w�k|~n2��!;S@/�D���z �@#s�,Wո����SɌ8 ���\-VY��(�͵�Cy�¶>m�&�8����{�r0j�����_Ȫ �=2�ڬns�����n���s���^�@Vܞ���� dP�o!;���_#�o*����%8s5;e�@R����D~��v�������t����X����6���6� �|u5�B�ꭚ�D�7��qY"����1��֠����E,Ϣd���=���3'�֙O�x��F��o��=*>F�o? q�.�/���P��r�7n?�~�*�`[�^V�,R)d�V�]Ǖ�r}"���Q�������k�Hgp�y�u˔Q�zZ0�J�������51���@�L��~Ry���'���.p��?��a�b�k1��K�(�8����l�ˍ':D��;�HH��3���u&,�$����s�N�����o\t����lH�v��ق�j� �gb'�C�b}mޑy<gh���ͺZlT5'6�y��bk3���X��w�W:p�P,��ӫ�4?�~,��~�ɹ�H�%@H���� %G�&}��d�pH�tn\�4)�x���$�(a� U��S����-c�4o՛sr�mJ�,��jc�W�uX-#�M�� Ò�e��8,-��YX����]d�\�\W��sr�(�8�|��HR���ԓ����$�l��E�@ؗ������(Rq�ሁ���,�%����J7�Kx�.U0��C������+�14�<���=;Ǫ�y�ɣO�A��Hd�/�_�YW��ά,��8,v3�SR�����,LZ�l��YJ�Cm��^�s��G���{�&����<;�l� î��.X����z�k^\x�[��Z9�V��������h�����p��7�@c��i;�.d�;?LC�:��(P�&S�� �`n�U�}�=���Z0�ձ��>R���s*X�|��c���,[u��y�7�$�B8H�W�챵�o8��Qz�p�|�5�Bn��?�VKf�+� ��Lbh��9+sn<r���1}����cē#܊7�un�PL����`�����8���#FQ`��&���C l��O��Xu#���{/b8����zW�V�1�������<���4��4���T��0Px%��0D2&>��]T��9�Wm�Ml=���0,�?�^��$#$����Mۙ�{�mh���˒��^��VҰUK'���&+s7��0�'F�9{ՠ����������D��r��d�T=�۳->�u��)��8�<�7'0QO֨�ZԆ��)���]� O>�&VEә����Vk�@���R�[7ca����=$��T��������Ayī��F�x%��1}LOÌCe��{���@����<;锻_��q���ϒy����]Ԙ��&�����ѕ"�Ȭ���J�fp��ؿO���j��E� M��0�,.���
Behavioral task
behavioral1
Sample
7a835935224e97578f4d70312459217cd4ec923f80b282779b55cbcdee192920.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7a835935224e97578f4d70312459217cd4ec923f80b282779b55cbcdee192920.exe
Resource
win10v2004-20220812-en
General
-
Target
7a835935224e97578f4d70312459217cd4ec923f80b282779b55cbcdee192920
-
Size
444KB
-
MD5
c183a4bf7f358dc6fd45f37b727535c3
-
SHA1
305dc464fb5eb7b52b3a35a0a3db1c0d7ef7dd92
-
SHA256
7a835935224e97578f4d70312459217cd4ec923f80b282779b55cbcdee192920
-
SHA512
4e0596a99237455b18a79fbda0ef1d51789f4618fad9ddbeaf0b6b9f0161f97975c1c2c693b5a5312565d9203c8d0ac34f7f6a420feb7f2d2627accebe4073d8
-
SSDEEP
12288:WCiIJuuRTqU1Fh/YeJpR3SSEU/QrM1HVO:4uRTqU1fYQESEtryVO
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
7a835935224e97578f4d70312459217cd4ec923f80b282779b55cbcdee192920.exe windows x86
ef8fd343d7da5217ee82d70e7fcfac35
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryMove
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 345KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 428KB - Virtual size: 427KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE