������hj�P��? O��BY�8o,��7�kT!!v��k�QTG���Y��%�K�����X�Y��H' ��.��AW�h,�)' �")#DE��(s}ݶ5k��ʉ�L�nlG�?�Š�o�H�͑�B�d�x�qNz��M��M &(Bl�82�Ъ�k/q�#l�fY���%��u�%�r}���Jɐ����t��"�k�6 ;}������)�J G����������jPE�|6uj3:\�;Jnv���m��&��Ԫ.ta������zA��G��[�$�Ĝ�nRq��W����a�1�qN� ��[�CF�T���jkct�_:3iZ �$�S��s&��N����!Pa&h�4��\"���٣��3>ɬ�����n��#�]_'I""#\!bɉ�ee8$���ة�� S�mEr]�r�9 �tR�C�-�����=z��'$�29b�ѹ�FgRÅ��.2"���v��~�R�;�����x����ܡZ��ˑr��*�o��>P�9i�m�N��x�+^���A�!@I�"��`��d�%� @�#�D��/Q��?�]�+o��U�����ӋKT��-�oS(F�I& {w���P��]�Q^� ������ϥV�o��іJ���۬c�ނ���f:g-�H�!qɮ�4M�_ވ�����1ʉ���#������Փ�<:;Ǩ&��W�y��`�1g�{�/$c���W8��rSfE����� MÍ:,��m����7�n0 ���Q�}/�B✊Pn�xi���_߂ c���<\��J�ɪo�͐1��O���"�*�����`�I�/�宜��Ŵ�g�2��[�������hDz��E��Oٗ�]����'��c��T**�UW@�D��yƣ������sP�\��Q�Fյ�D'������1�kGX4�U�H�n�pĭ�b��0��o�^˽��?� ����B³����Cв�j�m}@�4����������_���4/R��������=��������P6{H�>o�6����Ѐ�W��L���rr�����vw29G?��΄�+�A�y�Jx��N*6������f^�%i��5Tz??���*�@�=��%�%�K&c)�KX E�̸�:���f�`�SR�J���{5zv��1;v�A����^A��G1v�����m� [.z��A>�lga�0�ap�||��EV��?&�ب|�8R]?�&�D�yx)�Y�����xUV�s� �lY���$9 ֺ���HT~��h�Z[��!w�8#5�N�a����D��Qb��ÿ��Z��(�+B����q�M,áj`��h���0�F�0��zKT�]��x{�� ��U�t��}�"�; �)� 6�}6[U��E|��y@y��V�Ȣ�F�h���զq=���P\�)��+�[|Lˑ���s��� ��S���,�U��0����`�}9\mb�vuT�/��}s�T.: �w������v�Y�o�!u@��N8Ri|���7J���< b�j?5���'�H*1}f��UNF���Ȁ�������������a.��\.��G���$��N��,�6%�r���y�#����O��j�a���Z�eaYx�S1�z��7E ��-'�j���ܷM�ӻlux�������$g��(�%�}�;��HJ��9oa����re��P��o��/���'��}�����_!i&��^-����83j�#0��I`��!V ��;�[�6*��,4��l7SI%�,�(U�2/��`�d������/��I�vj,b�8Z����+��掍2����z���}"�]H��X�?���֠|2"��w��ދY������O/WG>�4kqX4�b�'F�a.�de�wq�F���D�^4�pG��@��էj5���q�J�y���7�;c�vXj;��y/x�T��ٚ�!��u�?���Y���25��|�c\C�n�7��=i���s�*�y�~�wY�n�8��E�Ɵ����lxБ�_�:jD�N[�dY���3�vt���w)�8[ڎG�[�*���ۘoj� �JTIzP��O�������T��e���@������ws?�t"�Z�|~�ud� ���Mj_���L�Y+X�� �U�j��8�O��biN{��S�Z�L�wQ@�h�ܡ����P.�z,��ؤ�Φ��x����������h��:���;�eF���\FF&��Ų`�r�J=�R��z"~���D�e��du���Ŕ�l�36��l��'$���&�85~p��b��`�O��3�B��f�*_��Dæ�o�4A����Z�&�kW0c�=k����AQ$�%��I�^����h3�h0a"�!Z:��y�)��}�\ՆÞ�G��O&~�����<?|� "g\P'r�X�%I����o -���k�� b]��К��nQ��%��6�go�ۇS ��{�!�6�nj����D���G�����>^`���o��!�A�`��\R���A������9U�A Ģ�������]�Hh:����ħ�_�n>��z�H��&��6N5!Z�s$Z %B��*f�ƭ�B쨉�Z��zT�%B<�J�����SYϩ�v\kIqz$����u��8-�w��@-�gl�Ѕ�*W�G��q)����|� �!�h�fb(q$���^�(:=3ݐ �_���˝y"�ӻ?KH����b *�u��v�[�>���Ir5 ѱ*���"x�&����EsAy�� ��~��٠���Ra��\���|��J������dK���'���x�L|�q>�t�\�iH6�:��C�Jw6hn�{������~$��� � J�E�_2�-�K�����f)�$����b����@����<���HM5��u��1,(P��i:f�Ʀ� ���s��<�����L�ي/3���I)=�7�;d����*�p}�řԢ����+="w)���>:�����շ�C -^`�ogB"vT�h��g~6�D"-�|&,����U��� �\��9r�� ���7���2l;i��i����p0 �
Behavioral task
behavioral1
Sample
0926.exe
Resource
win7-20220901-en
General
-
Target
8b891cc18f649324f1a445b4f01878e6d5ba919a8d92148f1161570dde61d676
-
Size
2.0MB
-
MD5
1fa999becc72c1291d7993c83073c4d1
-
SHA1
4c87967a0df6cda99be9e346d66cd389223e04e2
-
SHA256
8b891cc18f649324f1a445b4f01878e6d5ba919a8d92148f1161570dde61d676
-
SHA512
daa7ceffe80d7aba00ae6ef2d73ea492379eb3934eec5cedd79125d91d82aa242b2deb80cd83d594bb0a5673d9521d648a1e5068e59c0fb9d8bb63d603a459bc
-
SSDEEP
49152:lq8uvCY2xzNh8PZZe/DJlj810ZBG9P3j4HlzQivK8SmnnaoYYmP:GvV2PiPZz10ZYF6sElFnBWP
Malware Config
Signatures
-
resource yara_rule static1/unpack001/0926.exe vmprotect
Files
-
8b891cc18f649324f1a445b4f01878e6d5ba919a8d92148f1161570dde61d676.zip
-
ʹ˵.txt
-
˵.htm.html .js
-
0926.exe.exe windows x86
96adea13b6bf046c9635d8967fac2c01
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutPrepareHeader
ws2_32
getpeername
kernel32
GetVersionExA
GetVersion
TlsAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsWindow
gdi32
LPtoDP
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_GetImageInfo
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 742KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ