�O�~L�rl��P���aߗ2���'B��璛pV��V���MQ�k�U)@{��������Ep���%�i�-J��V�X�|��z�|EK���̷P49\x�ui*���ɦpO��^ʝ�s|_���P��eY^MPMB؈��K%҂{��-�@Ϸ�*p!�l[5V�6�(�Jl��������7"G_α-������(��2}�L�r�Mi�V�gF��E^��$���!_��%�+��z��͆��hS��\0t7s���`����]F�#��.��/����9: �W9�����+_�t���Y��9h���T�V��Q &���o���I���g �}�C�� ��S%Z��S��)� ��O0�q�Vmd-��vo?���U� i%6ig�-O�n�p�9_�+И &�j�Q�`4�Nn�Ĥ�/@�d����?�UD��k��5�Q!�S_����m�<��-F]����z6�/����E>P r��^��"�Nf��D��2ԛ��~:����]��Z6���L��u����f;����By��YL^Km�Bʠ_�`�B��yl�#�핪lx���R�a ����9�=�'�FV��u�����To���L�2��IINFh�����JTxW�hB��\w���/m`Лt��d%���6�'���.Τl�]�;<8�MJ��J�Ҋ����W�To�ԑk*�5Lfvq��~�τh"'��6���d5�k5���Uo#WR�5"t�]~�u����2!S�?����bo����+0����YX݈$�D�2A���d�= ���!��&{e���ܮ30\7[77����Qu+��|\ >'��-��D�mo8�O ˵G�<��@�x�U �4&�=�S����ʵ����4$�7+�V�Σ�.|������^u#A� ��v�#K�?ԬI��� ���،��N��g�kb�>�{������|���@o�R������?Wz�Nbu �٘'��Q=��d|���&�A��_��]"N����A ��\���y�fO+�vJ럒�j�v�<���kݶZi�Y\���W�Rh_�c�~�Kݻ�w5S�p�}A�xyJ5;�ȃV���8�\g}��e t���x{:jhf��,��&�!将s t�?��ݚ�G�GS��`����aj<��s �.�-�a�� U�[������֜:��hS �s�%z�WMv�wp�~,���Y�D�7,7�)<���Ǡ��G�L]-���f� �K;����^zu�LIA�'��qJG�A��p�)��K�T�6`ʐ�B4�# ��(L�^KH�dX4��Jv S���"zj�Wzfb��i��O=;W,i����T�D�Zq��+�ݕ }�����TO��M�is!�X��G���4o�b�r``��=��:l7q ����t|�d�E��ͨS ���!��<�B���l���ﶩ?�Mn��=�T[�J��L,��\;x�ج�4�ok��:]�z6����Y�_>ހ�P�ʒ�:L���0���7�~5�o�u]��M��mR20B�[O��i�� �s��Ѕ@�d���7�CC�R�p����䙄�ق�Z���p��[I���#�2w<��2���q/ǣ�Bƣ��Nj�X�����K*����4��}!wM(����Se6�z�C��a]cܑ �7�ф�L,�0����h=����G[~�������\������{m�k�?���v�œ+�J@��U�uC��G�-���t_[z\����]e��E��$mm&��9`0@6tPu��/��;�=��w��X5Z�!��Ⱥ�*Ұ��4�V� B<��i��4Q���+�면~��6+������an���|Ø]ޤoH6�+�C3���*Ko�DZ������\6a��_�7~��B���g��f���fY���̃%�Ay-e��J#�PR15iz/*^m��{N���n���Dt��k��>2�<�q�{US1��C�[[��1�����}���?�9S��[)/���3`I�To���er�NIzO���КL;PV}�����X�G_�0�E��ܙO��_��8g��d���ؽ�I����(�¹u�Ň��[�Z/�iw��&�8j�N�p�d��h��T�w���f��0!^1����[�`��M����g({�o�נ�:K��AE{�����'���>,�:���/�{�Ί�&z��&0�7��9^�Uæ�X`�< ��Ð5{DVP�� � e�s�G����כ�«-i0�����:��9ŗњ<Pl�Fj��Q���ɠ���+�;"����#Тyp؉l���@||��o~'�Q_f��o ��:��|-�&����aQ,6�d$�txf�����vA:�Weh=��_�~�c(O�����o�]WB�?��:2���k�A^ɠJ`�/�"%��KpG�`��ÝV��/�O7O���o��ez(��0ΖӶ�q]��b�q��Ӂ�� �Ij����T5��+>��p:p�ա�X���.������8�c��7=�[�a�S�>b0db��;\~��3(�ң�-������?�ʺ=pƤ���7v�9-[���G�f�� +>�ZB�<����S��U�)Xg���)1���C,�^�_�Nc��?�eX�TjI*ۗ�EE_�|n? $���Ⱦ���t��m~4���S�'��b<���C�ݮ����B��o��n{�����_�D�����Bg��E �KÜ��̰P�n�;ˎd2㏶"�wS�����&G��4.�,Qf�^~!�;��D{�$@���gQ��N�i��n�����f�V�����N�Z�X���i貌��/�2gd�fN�h��|�u�~��h�,��tB Z9g��_�� U ���<{�V��S�$n�®.���!,_ ���,!��95�l�Υ��5<\����x�= �kFrj��1��_44��a�g�4_ 1���c��i���/��8����2"!��@��<��#�rw� �����e���C�85f�C��������S,�Wpc�וڇ��TG�(���'$�eX�H�#��jV�����d�w Bε"Q���}OCE�ݓ.���Xb3L��<g�bR�+
Behavioral task
behavioral1
Sample
0a1367e9e81349bee726eef5801af5ffcd7f10525694fc9fdae6388385a8ae58.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0a1367e9e81349bee726eef5801af5ffcd7f10525694fc9fdae6388385a8ae58.exe
Resource
win10v2004-20220812-en
General
-
Target
0a1367e9e81349bee726eef5801af5ffcd7f10525694fc9fdae6388385a8ae58
-
Size
3.8MB
-
MD5
5ce7b7a93421ccc26bd3324805e2e9db
-
SHA1
e8e302d73c1df162da2928eb1261e0fdceda53c3
-
SHA256
0a1367e9e81349bee726eef5801af5ffcd7f10525694fc9fdae6388385a8ae58
-
SHA512
804bc74fe9878364a6fbb56492de5478ef4f08eee3e17605826048c1cb688eac855e0474f4dba858769eca68a871e9d3cdadf6208518687583a36a4f4273f42f
-
SSDEEP
98304:j+pw0mZ2aunm0EIRgaR90tDhOYCnN9/nK5KGs1k:j+8Z2Bm0BPutDZui
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
0a1367e9e81349bee726eef5801af5ffcd7f10525694fc9fdae6388385a8ae58.exe windows x86
a8c434d8f3a61e9143236bc318ece075
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnumWindows
gdi32
CopyMetaFileA
msimg32
TransparentBlt
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
comctl32
ImageList_GetIconSize
shlwapi
SHDeleteKeyA
ole32
ReleaseStgMedium
oleaut32
SafeArrayDestroy
oledlg
ord8
urlmon
URLDownloadToFileA
gdiplus
GdipAlloc
imagehlp
MapFileAndCheckSumA
wininet
InternetCheckConnectionA
ws2_32
shutdown
oleacc
AccessibleObjectFromWindow
imm32
ImmReleaseContext
winmm
PlaySoundA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 290KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ