|��m����e-�k��_��9<������]����Ս8���2n U�3� ՝��B$L�j`��K�a�5�i >�ҕ�x�^:�c&ܱ0�~!.g������,6������L�~�B���Z���� M/�YЃDʻ�����M��w���y�� �j�������Q|�eN�&L�=��zܴhD��Ø�� ~��\f6���Sx�<c����F�j_� �lAg�~7��U5����؍�N����m���P@����1�����7'�0Ӆ�R���=�9ɒZ��t��Oe'���:{�x�q��ŏI���腯 R2��Ʈ�&r��nVv0F����xf\�[��:���mg�úc�Q�ӷ���o�J��0�q����z)�_"�1���s2����9x�zp��AG�.�dD��f������n0����ת�a&ɗ���~�����-F��K� b��a*� �ԕ�5����`����eI��(�%^\���j��nU5IX�rҀ�e����c..C�����PfGa�$lq����{^<h�8S�~� A�#(.\H����n�c���P��՝���v��V�ӓ��'�����k!���x���3�"'s�!i2,7��$xtJy�KI�lL5i��U[�Y���hEm�,"���"�n'�����έ�-1@!a���e�N�jtχ��K����{���ɟ@�WȐa�͆�7�ۈ4��JlpAiť��� ~�� ;��8��o� 6Q�]����Vق #'�dY�A�n���� �=��I��t�zd'�`*�u�T�[��-^0"�p&��P��O���}��8=Htg���=��ڕ��1CFH�@����֢���Qr����XDKwi�� Y�]uDd{��I"۫E�q��Oy��Wr�oZ���I,�1����v���:"Hw�eʥ���@�gm ��Ɗn�"�����V]�ss�M�")>�P���꺻�}��ޛ9���&�.������b#�ha��TG���Tir[��I6�Q!�k/<Y�B��,�QoyIK77%�9�,|�Ng�4qv��&��@g?����/�Q�vx�_<0ҽL����[=�b5�]����֤���]��Ť#��Go�U�~;R+{I@��� ��8Pk�ܣ���3����4t5��]���Hا8 +����7��ƾ��\Y96ߖy�ǽ�g���ó�aa�6���m�<�?�������A���_��')��$�㧳(���s8�±�(�QqI���5�n�dy��a�_:��N(�y$Q���8|�u��#&E��+��*���������?q=,��:׀&��{��8����'0�ve�����O����yA1a�rnj�s�L ������P�%��Z��]�3�y�kK�� �8�MS4^ &����ij��d'��Z��Y���51j<�TNA���)��������~���~��I�t{��p�`�*�G` ��� U�%��*��Y�����{�)Z�0S��u;26hʻS�������ˍH@����k��)�b�2��kV8%��@)V�"�D �?�*�0�hX��6�k�>A�B�̽�'Vm;OM�#TB,��4�g��6c�m k؆.�\����F��*�ϙ�jGw��0�1��A���&W�&�-l�Q�3֟�f� �!'����ֿ�^��(YZ�9xK�Gή�� Q��R�;%`b�gAU*z�$��~��wy?�����q���>P��W���+���q�h��q}+�<e��,dۧ��u ��4��-�K飪� N�T�� ��d?�N���ij;��������Ӝ'c�Qmx�P3F8%-�<H�k%�Wהݞ�U�'�P�Kj�o{�$�mp��������c���@�%��j�����QVw ����ֶ���q~�A�u�e|�����c-K3��QD"�hǡ+�A�c7���)�h�96}'��h����"����!����k����;� �~��x�1���ר����\;�>��y6?����v:��ҧ�h8�&)���E�:!�SP��%_��<�(1mA�LJKsw>�AR����\�Z=ki�ՋD�!9�0��á'������u4l��6���t���%M$0����w,�H�׃�u�(Za<���p����E�2�9��Nȅ8�m���_�I��Ժ�x�M��c,���u�d�N�xPm$=I �ٮ}w���?����gA]�0�����Q�a��m�9��fK��� ��CWI��R<������)�C���lX{�4q�*�3Eu�蚎�J�-��-��˩��`�N�&M�b_�����"e��Pq�T�5{W��tq�����z豶Nׇ��y�w�f<_'�\�j+�>�o����?'5˥�7I�v��'�OM�C�U�_ ��D���q��ݙ�hʖ0�6��G���L�����_�&hv≓�&ˁTN��`^�1�b-Ȥ��n��[$�d���� �y9��#qY<��Ƶ��ͧ<Tl�eJ�~��g��:U^���w�~����q�7�_�wC`�����qX�����|�pO<Y�`w��v�� �^�^� ��"J_�J�.{�K���خ/h=�?�xm͆�a�fS�q�/��#��˿ۺpm�\Rr_Q{2�w�����Uap����RI�(/��� �r1��,$a�]��9���^g��%�ظ����{�[&DK�mh7C�"m$�'�:r���Q�w��9���?������J�I�l� R@֣'�+��E.��r'fr�gj�����8����cҋ��*WX_�wv�怜��S��������I�P\6��&R9s���v%�:ؼ�,�8��*i��b�_��xb��.�ϣ��߮$ʽ�J��{Z�0O�D��_��������n�b��ס������+�=ό`��_�,?�>��P��8Z���X�� cv�[�Ȧu()y�O�]���J�pi^Ci�ZH�g�'��T��wҎ́V%���=p�϶����%{i��_�I��A�:ƩF�#u#1wWq�Y.�de]�Z�v�'=�1B� /�Lh#Va�U��
Behavioral task
behavioral1
Sample
6f9791cb4dc4967b567949a1faf3f21b1b9ee1f6525f0e1d5e5f9d1ace4bb75a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6f9791cb4dc4967b567949a1faf3f21b1b9ee1f6525f0e1d5e5f9d1ace4bb75a.exe
Resource
win10v2004-20220812-en
General
-
Target
6f9791cb4dc4967b567949a1faf3f21b1b9ee1f6525f0e1d5e5f9d1ace4bb75a
-
Size
2.6MB
-
MD5
506de11ae7219c48839287f1309b7f0c
-
SHA1
a328c1bfe5f1198ad0cccded8d92e9d28b4b00d0
-
SHA256
6f9791cb4dc4967b567949a1faf3f21b1b9ee1f6525f0e1d5e5f9d1ace4bb75a
-
SHA512
07bb0cf7e9183db39098084dccba6c0b32a3cb66a7d0e9864cd8f1b0208d57742461eb2bc8b8a761aa0526ad7b026e4e1c48b54e8d002e91743a025ac35b4dd0
-
SSDEEP
49152:by7gl3jyjm4Y9av65zFs17rOhl3W9UcsLgKDOK14rvKARYmidg7q:by7Aua9BdF933WtsDdcvKuNB
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
6f9791cb4dc4967b567949a1faf3f21b1b9ee1f6525f0e1d5e5f9d1ace4bb75a.exe windows x86
3583697765e1bcc4c4a1097589e0c5c0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
rasapi32
RasHangUpA
winmm
midiStreamOut
ws2_32
WSASetLastError
kernel32
GetVolumeInformationA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetFocus
gdi32
ExtSelectClipRgn
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
comdlg32
GetOpenFileNameA
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CreateILockBytesOnHGlobal
oleaut32
SysFreeString
comctl32
ord17
oledlg
ord8
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 939KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ