��[��è#�Tú4��cc�G��M���(o*���hn������O+n��6���+JN S�O��YXzZzUڭ�p�ֵ���0�0�0���d�|��--�F ��XJ;��c& xgK,�k��8\�S�;��l�9`���FO����{�@�T�) p�Կ��V� f��9�B�Q\`ۿ���\���v,>���d䠂��3�-�˚n 2��/�0vN���Z�y�w*�2���s�y�lLD<�h��*�1lX`�1>n�!� ���� �� �l=9/:���^� ̊\:�lc�>:�V�D�}i�)�Vk��?��h�ZA9��/,�`.��n��49�Ȳ��"J��э."����]�^���C�B���W�i��J�T}��y�� ���ڹ�����<2,*���&*!� � �6C4�>˩jS��y����!4o����=�ߚ��~�!��Q�x(����.����e����Z�~�Z�.���B�'4ҙR;��� �'E�*�d��7�^H���7�1SS��rj�!���^��n&_ˉ��~��6�?w�fd q}h��+��z5U:�#ԇڪ���������Q*���Q�Ǔ8^.n�{�ޝɂ�lvy��a�����۸r���̺,�W�GL-4RX��V>����V�r]�8�,����tx�"c�:�����l? �U6\s����ڂ���uOZt w��C�c���E�e�s�������ƴŒ���|0jez{i�7{�kE�{g5��x���L>6vb%+r���*�bZO�H"����� e[�3��%��x�_;�����N��:���(�}@����!���U0haǶ��2͓ŭ��3K�oxp21�7"V�J��M�c��]/D�D���-�䌹N�P(�s0vU���cjC���Ij����UW�hY�\�k�(��?o�<g�oLQ@�A�C_�Yϊ����D�+����h��l��Ne���|Z|߇�l��ʣ@�9��r���R��sثfj�3���6+�A7���l�h��]e��^�r��ˎ;/;!���jX��B��.�V<=q��� (�/ �;�<���t��^�@��fPn�aR��@�� �#.��趝�PS�-7�y��(�������*���QƙM�ꠂ��pX�O43�x|�!�THH��%;UObEXh���ko=o�W���C�6�z��[9l���P��.RV�I(�З�3�C��@��4!�D�<���Tf�Ȱzٹ|��/P�im?��ΆnzPS)u�5��v���$�Tv�� ��\|�����2�� a1��b��H�����7;�Ru5��p��pI��Un�a��Bԩl��l�B�C�I�b�Z��t���huoearߖt9�Y�^��,G�7T�A~�5�^F^�(lB�:�v��ʁ����?bM@�����C� 5�s�M��!� u�����vy��}�FZu9����0����%3b>S��\F���� 8��wΰm�j�4Z�/mC?�g��:�h�����]x���#19sƧU&�:WUS�)����s�F;WQwҼEڻ��r8 a�������j�{rV��1�+���`y[�e(ѭ1�ռ�L�[&2?�+R�zLG��p͑)?� m�����6�t��kdq^m���51�,��<q�.���O�ӳ�|@z�o��ԗ6T��fM�� �^�q��2OP�� �]�c��������5����Mh��g���,օ���0&�z�J���D+�J[c����'1�$�3_mL*Azp��"��3�5H�Bq�i��afK�>�0Hr��:�4�_�{@��Bz���:�%@X7ꠂ���-���ZpԜ#��Kf�䇛���(-ۺ*AyV� (��ׄ�Î�>�J�➹�KW� ��J}���j�^��]������\�הB :��^i��4R��5��1%��3K��uS��W<��"Ė@��0P�u�d�;H��xQ���n[Ďi���|:�|Kuє�`z��5&~�,(ێ�oHd"��G �K�z�Ѝ, T��^����&F��B�c�Û'zր��2�����6S<Ƽ���D"�b���ۛ|�[����饪�-~xMs��}���K�kv(���-,Rr��M���(f�b�p9�E6�ͬ#�z_'23�[����&�#���qNe ���ZB4w���վش`����K�q��A��E����'�`�3�T���x�J���.�����-A�}��gK�z�q�e�gÖ��,%��#+�Q�A��<�Z�|����y����Z��c��!�_A�x���M_ ���iJ�r0�"��E��ALJ%9���Y����+�͙L~Wl0x�;䀣�7������L�Re����w��:������%4�G�j2��q���:�2ܟ`�ܭ��7��٩�?��[]_��;(� ��s�*�Nd��W�?c�-���n�A ��c6pC����Jsw]"� `�j>P�WF���W�MG�?��C�ru/�z+ �X־�؈�4+���רL+����Km.u�Ŀ��� �t!����I��@�w\5s��;��C���Є<�ε��=�`��E���t�S��&�t�E����\�<��B�o|9BV+3�\'q)l<��� 3��F���?��N.��r��7" ���l6��.��J�f��.�\k�;Ο[�C��|ЋtOו��� N���B�95�z��?��r.�P�M�R��r�?��v:x�~���|��x�y��c��,�v�0%���������F�6S�W�R�ؕ1Ŧ'l�u`QqĀ�'+���_���D��oh��խRɡ)W ̇a��&���)��]JęOm���R�v��M ��[�x,��"bJ^�M铧D��r�)]u?�PXUX!%:t&�+�-��(#�>�� ���Q#a��jU7/���b��6��5E����I�Z���� �� �>��������&[�2��B��ϟ�$�Wf�k��+<�����=w>ͮ��D�eJ���<P����1؍'�ᥧײ�^7�xR�2������$|6(���η��3���#B`ށC���ml��I
Behavioral task
behavioral1
Sample
a2b1033db60762fd495b4fca7b1b1f4e5c167881ac30fe77be4f2d64b05f3c15.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a2b1033db60762fd495b4fca7b1b1f4e5c167881ac30fe77be4f2d64b05f3c15.exe
Resource
win10v2004-20221111-en
General
-
Target
a2b1033db60762fd495b4fca7b1b1f4e5c167881ac30fe77be4f2d64b05f3c15
-
Size
716KB
-
MD5
4b2d1e2d5bf7d4ca6f4679303a2f776e
-
SHA1
f1e7b975b33f2a58d280c3ba2187ccc0b86a076d
-
SHA256
a2b1033db60762fd495b4fca7b1b1f4e5c167881ac30fe77be4f2d64b05f3c15
-
SHA512
71e84fb35fad3f697f12c431c8be702f66d4acde14db9c3b9b98b26e019c443b304e1ce024d3dd15e091e02cf90e2981633e78b66dd62c5fe572a50471703840
-
SSDEEP
12288:/x8D7hf4Fxo2qpiBi2OTOYVDk8Mu3I4NpQWk+dPM3JB0E10Tn7E3dnl6RKjQ:/xkFB2Sp2OTjVo63ZOyEW/E3dbc
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
a2b1033db60762fd495b4fca7b1b1f4e5c167881ac30fe77be4f2d64b05f3c15.exe windows x86
24a0eb41b5fef8395c6da74d48a3fc72
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
MethCallEngine
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 668KB - Virtual size: 666KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE