H1ʝP���ɗ�������9'�(F�#y��T��ߍ���Oi���F(��J+���W�卡�19��u,7S�h�THG��[Q�x�<g����.�ƻ)�~���,1�O�ϯ���t���6i�[͛��cT�������\7@m�"�@����6�� t�>�����]�A�j�V� l)`2�Z�n��������� ��ʯ��W��cw$b�gd����6��*�ճ��zp�T����?��'[w>��]�� ��(�z����>Z��ˢ���(X���(����ȳ*��"�Ȳ�y��'.���xdv�*;�����c�2)�!'���&�7!��[��t� ��%��P ���f<}K�j�pb-������q �Dц *���+���#�A7���$l�[��I�֔�l�W�жƟ�Vp���/I����I�/E��t�9'�P?w�J���`N�;E��c͏����k���)%rd����]��i���ؠ]�BQ�'��-���5�:��"[��!]��/-]�{��䒖}ƻ��S�l�Ǭ��A�k3����X[I��*x����-�{/����&��)bv�kR)��2����(��H���^�Z��n��O��Աo�[�t��F��q��&���5p|�b�E�k�݁I�bJ1F�?���xo���q�cO�2�����N�=W�js��HCB���Fq�A5:�іb47��v�(��!�Nr�4=77�>t�����~#m�sR�y8t�&��0�Q7S$�ν�6m��{��fi�i�������ךrXm!B������Y��4���R�<�h��ٮ k�"�����)�����~e���w�\����R�p$/l���n��*.�d���x���zs3ؠ���Z���T�k���E�م�=���!?�-S���Q��zq�z�l�u�M�W`�G`�Ӌ��T5)��*9���������|ul�!�-���M6�%����\����{9u?���9=U������_�^��+�,�������CТ�]�wg������.K����i�Tť �:�p�`;6�w�p��q(�;��k̾͝��.�W/[T��?8�g�>��.����D���*&P���Q�U�`حcPɫJ��K{C�@�2�N�Q!���K��zMӪO�g�,����q8�*�VL��Bi�bw���m1�`�u�lDў��Cx�S��~/�/��?c�I� ���̑FE,��"N��&��{f�ӏjg\�*r�Ba���dp�n����s �=$w^�8�΄刜���9�M"@��v�<�)}�%[!�h� ����Q79��T��(��J�4�wb������ ��گ�S��z�����W^�Cߒi���b4�-�c�NT�$����~Z \��:8�zȯʫ�j!�BDE�7��v�Q\y[U�Fa�-�:�����/�di�إ�/P��8p�n#tF�\�����H�+1���n�pOJ��i���X��+�[��hT����1�We���˪��1��c7�� q5�K����k@�)�Ϳ�e2��Y��=���88�Nl�k\�8Y����:*�>�2���Ql�,���&��(紑g7�y ����)�k�_�5�ٛ����[����5č�F�s9SZ`� �G�"�lR0�8�I=�iB���D,HK���֦�W?�tHs #J/3-|j���w {��`�N�4�o2��,wwg�3��VC�H���^_�KYͳ��Q;�E��m��:vuxޑ����v"�z�m���S�9mk�� F �xi7Rk�HlԯNDE8��<?��^#�FB.�WsT5��.��M�⏔�g��3h���2�� ��@o�V��sr�?��/���A���E_����[�<p_�S:����p=>6�z�^��� C������֥��+(S r�oGу��Ī���JO;�x�s���F� ��|���HA��Ȃ�0O�*<I�&C8�ʻ�8O�&�e�N�p������kYT���ÄI\��y�;�;+��]T�����/ǠʢO�9שT� ��dr�gE����0u�V���kd�/F�ڤ� �C����g�q�����]!6����Y� ;�gS��{IMe�b���0Ν��Û��h(��!��-q!v��2{\�H�$ ���EBZ�0����q��U�Ş��v����P��'E�Ap����z@���0��/�}�urX?����u�Mp���X���B�JY���U�X�>���۫����"I� ��c��T���{0���P���)�ŠWWw|J�Z%[nr��a�X�]QI�o�������W߆u��*�t�a�n(����<��4�?�� N�lN+1ҫ"�/}�O&`5�0�ڦκ%�F�9���:�� �LO���ZY��u�q��k���00����M��k9/�ٽ�^鷳�>,EʗaBX���=q�A鲑f"Z �h(�d���A��⩛IG�@W�E�ϘK�?�s����i��Ȩ[�C2�M��*�_�6ݴ"�D��8��1��r[���<L��������Bh;k�u�E&�M|f�H@�lr������Ŏ=����ԁF=,D���/�@�k;r3��Vy <Wt�X}()jК&��&; ;`���֙_���̧�YJ��E��U�O�XK�n�_mCY�/S ��+��?��`=rS�O�x�D�(WF8�P2�z��d��E���WA�5v�,�Ȍ�F�D�)�����ĸ 7a����M�)luӌo���<�[#����Cb�1�r��������� Y��L���) ���l��"U��I�?�C ��Da^i�X�'�i��N?�3����]i���\�d���g'y~����5������{jS}H�CX��=���q����g�����������d6U��N��@�Ԍ�𠥌�o�� QQ�gk@q��[X�ʖ�gW*%�J��}���9S�J��@<I� iqf7HJ��BP:c�/|?�$��g�˸��=Ľ�1z5�|;b�nn�k�$!�F�=N�W��&����g�~� ��������h ��ݬ��K��N 3��۵) x
Behavioral task
behavioral1
Sample
67b5fd1754c229407f21ae084ab6cccd3100478e45ca872f68274ee19dde8ea3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
67b5fd1754c229407f21ae084ab6cccd3100478e45ca872f68274ee19dde8ea3.exe
Resource
win10v2004-20220812-en
General
-
Target
67b5fd1754c229407f21ae084ab6cccd3100478e45ca872f68274ee19dde8ea3
-
Size
736KB
-
MD5
6db25c22147139f10a73befb1050f9ed
-
SHA1
d6f06e6160a8bc4a767f6cbb7edfb6139f3f291f
-
SHA256
67b5fd1754c229407f21ae084ab6cccd3100478e45ca872f68274ee19dde8ea3
-
SHA512
04e4e3df1c2f3582508a31c5769e5098bc8b68b5adb10551a64534f800b4a5f207b056352adaa189ccf252423b34131a96497f029b4285890324a9f46f2a4137
-
SSDEEP
12288:3rLzYIubBjwFB6sGK7dXAVBj6LyRL8hhDK0pDg7K5L9Gpk3h/:3srtkFBBGqaB3YDxDgux96o/
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
67b5fd1754c229407f21ae084ab6cccd3100478e45ca872f68274ee19dde8ea3.exe windows x86
9bd928c6769f6d81ec79e6ebc9336c6e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord608
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 688KB - Virtual size: 687KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE