�h�!�� |��ɐ�T��'����@��Yh�MH@����%A\��X���p� �($呑y1 B���U>`F�#�:��u��� E�|V��F���������s#���S-����t1�qL�������){u<�����l�}����Cj�qV�C��Z� 'B��|�잢���|��~����X����� ,��~Ф�� E|���g�.1�s�юd���Mr٧}Ӥ����Fx����`�#���Mu5x���(�����7�e{���:�"�"��ӮKw1�L��A_�"��t���G�Mt��*>�{J>�.�)K�D�|���=�aH�4�/��s����[|��� �^S���H*��i�.��I�TR��V��Xk���`YJ�22h�w��5E���n��f'Gz����G�;�t��B����N��u�XATO��خ�@5X���R�a�d��I7���r�z��>�-$����:σR�U��$��2�Qh�'F������L+���KCږ��6��h�{}�럧�ܐD�zH�"�OLtI�vi?� �W����N�,X�Q#J3�c�;5�N��{N3���ek�����]�q{��<�q�a��xܭs�Oy���yy��s���2�"h����L1$p5�k������D_+�=�촴����Ԑ;]�ܣ���m��FJ/�K_�`k}b�U��p��l����hA_���(*�H��x%��5$��̖RM��&����bZ���vA�_�p����ݤU@M.j&y�־�a?�-����=��}�|� �ִE+��"u'i���:)<�up����@U��Su����1�����}��H���\�R��T{%�D� ��&���/����d�2���%uVv�cO_z�Ɂ�Y8àA[��a���ϵPU�� �A�A�E���7ư�.�8 Ѻ���H^�\E���RP] i ���)8��y�%+*�v`H�����8���@��������gv8��i�i#���&��ƪ0y���_�ڈ��+1Q��OJ9�+KwɃsW��cqۥ�C�w Ng�h#Ȋ8����>�1%Z��?h��Թ�8ܤ���Fҋ"�-6g�� ���Ț�C��8Pni��\�'V%�P혉��1��L'�F-Mjq3|t�z����T 7��V�x�t�s�� ����^�o�<������>y����E�RW�pk�}V�p�J �Gt8��4�a�5z���&�rZ�+�<L��i�76������q�p��Z��s�L�� ��c�y� �Rf��f�Zz�{��QNw����%6$�%y�o'x\i$~�ܑpc�9���ݾi�a���??�FK��M��CٱOJ�2�J75��ȑ��6!~Y�Bz��ZT/~|J̀���6�F���� b0x�S��[�����g-�]�AH3L<Eyŏ�?t��2Z���F-�A~H�O�j;����IyJ�Ɂ ,改�-�v�w��{l���~���m����ϥ��F��Ah��Rb��Ӄ�Ņd���""�=Is���QUp���|k�DR�e��NPZ�%�=���b��*���G�ͭ��˦��Ia�K�\��z�Z��$�Z�S�/��n�Ot�����J��)���k0�ˑ�8^CZ�hs��]�˃ �Q>v@��P�N�uɉ4����N�ڂ?!�$�]�`v�Q��;DxT�{���bֿ×�Ъ�]K<��+�"�}�US�i��=���r�(]�f�6��O�� ��8v�3nET?�x��r��*w���E�ɺ�>��I�_x�X�V�7w�(��Y��v.�3s��Fm3��g��A�K<��(���H])��<��M3ةI^�WU==�/ ���Ć�0��J`3��J�x�8��,�Z��جcb�xO)@5~�+z�����~^?�^�8���*!��1�Η�h'��xm����eyO3��z��,A�}�H���x2)�4�~g������8.~D�$��&і�«_�L�j䀈n���Z��Iѩ�:F�aez5FC���1܀��~��wrb|�B��{�����|G�ZDm���JB��ju�rPm�!�%����:4E���$��F<q%�>��������z�����]H��Ò��Z��Ю�9�I��\���z k�~O7{T��H��k��,"�����^@����5����ْ���#���g�j��ѷ�N�����8K�b���c�I�¾���I�i���~`0�/���RT\O_[����&�OK��pP��f���A���?U9". ���ï�MP��=*�@���I%N�9�����p�x�5jS*�+{!ڡ������8�����E�@qmӠ��t���Cp���_�MU\�Ќ�A�2���$��Ox��D��n���m[��� H�8�a�r���Ш��bu��-�=�����S8&���������ClU��<� m|���pX�1�G� c���/I�� �e`@[���V��i�y�N���B�� ��_� �h�_�5�N�ؖwv��S����Bj�2��<��ܒ�L��L�"��SQM�z�-��P�b��0&&��:Oz+O����9���r������~�صqj�f������0��r��`�,j�\,��t��N���4����ct�Km5n�8 �IE��|�"G��u�Ұw^��($���G�YV*��i����"�v��)16}�2$�/p�`�cR�Nxc��N��"[d3�^�Ы�V����`7:���A�z��1Cv��?�z�&��MUx�����g�LO�;��:$�� ��K8�4��QwQel�g����t��]zq�m�'B6���S)Ng�iȎfe�n�������LXe��R�)Zy�x�Җ� f��N��u�ȐT�M�$.Lu����{�{�> ��L�$m54G$� ����&���)��+��~��S2!�adz;����w9�G5��^њ�;�~�c�h�ņ����e�ȴ7�V����*���xhDb-����~+��p����ȽH����~ȓ����&k 3�f� �7{ 8i]a`�<fA�1�������4�! ��(�S����!�!B��R=��nZK����ٰg�㓳��|��.��
Behavioral task
behavioral1
Sample
8d9734527c841c29ee5e4aa6d3b43ee1f30a382081ff37065487737fcff41753.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8d9734527c841c29ee5e4aa6d3b43ee1f30a382081ff37065487737fcff41753.exe
Resource
win10v2004-20221111-en
General
-
Target
8d9734527c841c29ee5e4aa6d3b43ee1f30a382081ff37065487737fcff41753
-
Size
7.0MB
-
MD5
e00332401e4ac385f71f49f6aad97438
-
SHA1
c654ce8314868e7aa7fa737a67c35554a7a5ec11
-
SHA256
8d9734527c841c29ee5e4aa6d3b43ee1f30a382081ff37065487737fcff41753
-
SHA512
e47f4d36a9395ee29f0077c34da71af5dbb64efb73e60e33f75329faae2d135d121db41a691550f926f5ce3490eebd693d4c213b361b723881a37b78f43cf35a
-
SSDEEP
196608:8kCe7jIACDXCrSyZDl6Iiknj2vITkxWWx:9CsEACDyWODMIRLTGz
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
8d9734527c841c29ee5e4aa6d3b43ee1f30a382081ff37065487737fcff41753.exe windows x86
94486179628fdf9afd4bb9884fac14b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
LoadLibraryA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegOpenKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE