T +�X&��1�uyl����_�(�t/g�oJH��:�-UR9<�]2m/rR��ݪe���LV�Sw�ҼW�06!�.�*OKEf,��KƄҒ ��M�mK�i��#���P:���ă��Oy�2��3Bܧ�2V��Ѿx�gWW����6-��e� ����U83�ȐWv��l�%�^�*�ʲL��O�����0������-�;"-7[*��o�����|BQMoW2)�d���6~�S��s�����6'�������h��I�iq���K������d%��0m��(CS0��"9t��e��RX����9�>&����ճ����lI'$��۳|���� �H4@�:p�d����(=Jb��@�g�~�]�W%yCN��î����w3�L���S��0;�m�))��ۢ| C���ƫTi�W�C�Yp�`�U'��eT0$\ć%�_�RuS��i�"�a��6�~Z��-�"�?eF~�� t��Y'i)��n�t��6���1��X����'3�� ��+�є��o爛#&�F��B�[��R��J���yPa3�4Ja���J�s�8�����w�J�'��ܿ��Y���qd8�i��S?��9�#�q,$��$�7J%�ٝ��c�'1q%��&�����g�\�@N��* �[a��ž�p/��Ƙ QB\.w���nz$��T6.�J�!}8t Ղ���'' w�|�@�*�f��vr�%��I&g̢�\�ڭ�Y�sŸ`�R�H���ՅzQ�5�=�1Gr�̯u���pr ��ٴ��L���n�|�_&䓹������Q<����/�|:g)0W�]&�\=���`*`7���QS Vx:#�~�h���eG�P�w���#��9Z �AK�J�K-�<XȾ!���uٜ��ߋ9���$��߂����էN�8j�h��t� ^c<����K���joq�7~��[�`�7����!m#8���F$VAV�T���1R������.5��|U� C#i�繑O)j�>7�#���Z��(V��2�X��k7^L��E��ۅl/Y�<�o{ՙ �u����#9�%(�|���9���?U�s��1�t���iӇs�W��X��ɩa�)u�1]�������?�8y���c�(B��$��g4%���=�n'��л����}�/��3��=��)�~.9q'p���xjDR��~��<�q�������ϱA����Z�Z~��i��b�������0 �E�;�GzG=�+�-��_ V�{DZ*��!өQ�wT�L�z?5S�{S��f�^�����A".�o��{���7 ۘ��iK?�3�ќ���l����S"ϧ����T�>��>���b�G��D%�͔P�<�g"��M���MI�ށ$�:�S!�}C����g ����Q�;��+ƾ�N��@s�����d�O�w�iˋX�*O�D1$�[�i^��׃��S�vk=r��fdS��J�f����Ψb������Q.���Y(��,t^�a��tÅƳ��R�;b�� Y\��h��mb�E ���|20O(��tQQ�u��g��Q����0g���ִ}edfh�e��)v��b����r1'X¥�٫�a�9�����O`��O�uWe������$7�Eϣ�$[0D[������Y�ƐA~���sZ\��d���4�K<���>����2F�q>����⣣¯ ����t�r6�'���S\h���ސ0�s��##�Ӡe2�43j�I�E>�M�w�#���Ip S-x����UoȈ4X�V���S�0X dl7{�1��6���*'��z�{-����C:G���3�J���~����ܧo�x��]�r1�K�N3����YOS>ode���p�'5��Y�sw������J�3<����'%��=�Iav�$�l��C�G�q�2t�`�ji�aY�BG9`ĸ&C�~�jK+���U?��#,G�e���O�=�ss��7��D�3��B.�_�QH]j�턔ԔB�i�q��~@� ����A������bEL�j�g5���D�g.*�X���}�������WX�> $�^���`�8(��M� |l�B �����]�S1��:��h��.��0Z���0 =ò`z�'+-a����_c�J�f�5�WD؈U��\c��lS�1§ߎx�I��ٗ;x��k��m����+*i���*$I&}��.)k����VA�H-:3(-u쏼*�^�S�����<�@�W ����ӂg�dcB��U�Z�|���%O2�7G4�d���e 0�O�k��@��}��"~����������=b�)���0{Ԣ>0��/{��2J�������q�N�>B����z�[4�=ީ.��dY"�t�=z� V@ �8/�?YQ���s�Q��?N{��8H,�0�BhXA����!7�eI�ޖ<|�;Ś��B���Cvj,.���`�p��)@3���X(��^V�g:�����0�(V�J���ͯ�BR��(���DTOs~���g]=�u.H��Z¤��bGxu�@�b�l��� �J�ż1��H����"F�����j߱'I���f� �n��`��_}�Xa��Pߔ�6��S� �q0_[�'�g��7C��7 e��]�_�tT �1k9��g�j�9ߪ�5"n�&İR[���>~G8���L�8�P\���EK���g'3�W����&WCG�Sݱ���bHG!ϝ+ޮxV`SC���������:Y[K���q�+�O�͍�_a i�����8O�-֍RJ��J�]�LX��M3̉�Y�$G� {�6���\ 1�Bj7j/�YQ�zv� �'N�i����i�0'X��w� ��{����@��[���ٙ� giRpX�=�Js,u�Xj-gO�g4Xp+y p�7�w(�7���>�d���*U)B,��,~v���.��M��7�������R2�|V��y�I�2�A�D�w������o+\Ew��A�M�'P�ȼ�>`d<́�^���T��0C�B� �c^b�WO��f��ry��:���ǩ\�E�����y-3Gթ kf��#������+F}�I� �L��
Behavioral task
behavioral1
Sample
9191033ee3d224e6150d3a5041a38b75bb1169cccb12f7eeb1e23a20ca2354fa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9191033ee3d224e6150d3a5041a38b75bb1169cccb12f7eeb1e23a20ca2354fa.exe
Resource
win10v2004-20220812-en
General
-
Target
9191033ee3d224e6150d3a5041a38b75bb1169cccb12f7eeb1e23a20ca2354fa
-
Size
720KB
-
MD5
dbf9e31fcbaa517c50be72135075ac74
-
SHA1
a4e2fc6a7d61634ad78377fb27ffc48de6ff9865
-
SHA256
9191033ee3d224e6150d3a5041a38b75bb1169cccb12f7eeb1e23a20ca2354fa
-
SHA512
4a0d7769a6fcab36da0a5f057e9a1b8bdd1be45ba0d5ebb87baa1e4489bc9827d63752a3174fda6b3c1fc465901458b5b9045ef26b0f97d9e2c39d0b6c20c4b3
-
SSDEEP
12288:aRu51JEHhxrrkBXrZMcU+mBC+mAfE2WMTyI5deKPKShF:aRavyxGXrZxcmuTTPKo
Malware Config
Signatures
-
Processes:
resource yara_rule sample vmprotect
Files
-
9191033ee3d224e6150d3a5041a38b75bb1169cccb12f7eeb1e23a20ca2354fa.exe windows x86
f96440580f44ff5191d3849e5b520878
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord600
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 672KB - Virtual size: 671KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE