�0a/oSw~5�le�XOJ�+�[k�ی�vXYdjVƊp)��v?�G���� ̳(=!�@�?�p��֡����O��P�-��8s���Hz�)�y&rs��X���5�6�]aX{h@�Z�d�t�?Vg��1�C�R>\�[N�⬻i�,#�"?ݷ�I���F KT9=`��Q �Ji��;�2|ɍ��!����Q)ChW�_�젝�W}0¬^���)�@{A�B�])*�Ъ�L�����+� �0mg�B���N,?QR ��1'��BI����կ���n��Ԟ���1�����N'���AW�@A9�O�W��-eJ-��������o�> Õ^���6Y7�뤹�{�(�<cm~Z�Px���=��?��kT�锚�Q$J�Թm)Xb�4��=��uJ��m���v�@��fOC�Y��D��om���\�l�:Ϸ�8�e�.�v�y�%�~�&�@��U椶�^�w^E�� ��՚#��î�.�;a���f��|�}��Uz�����(MQ�'�kA�*A�����%8Zm�l�r���D>W�lR����>�?Z���z����GBҜ�/�r��̹��ɍ ����x�Vr�Vۼt'~uc\����8�8|��K���!�BmtfV��5b�g�Or�F#���K�(I�������9I�D��ɿL�_ʡ�%�̍��}��I�J�_E;��|�Ԉ>T�/�}�<����ܗ;<Ý��}��Å�l%��-���VE�-�ce������z;�Qܛ���h���N�����?�^K�E�c�̊��I�wĢ�}�����9r1�5�r��֊Im�EG��0Mw|�K�hP�/�ܪ��ӓy���Mc9���o��$tL ^A=��3�Gc���}%��UD����"^��[;v)l0�ܩ�8�N��@�uF��!�z^����$|03��+��QX���2ٶ��:�%t�rw�v�D�7�<��╘��V&�IЮq_�u>�d��7˕ �;��7Kַ{�ї��֞�/Ӑ�➆rO�����@8���&t���:I���B�5��h�rı�ċ��`�h���w��j��%N!8��t�0S��]�I�r��+)����M���w^'ܘ�ap���Lٰ��h�؍k�$N`y=��M@�ӈۈ��T��� b@i7�K��^Π�@,W�Fڛ��g�$���f��(h���z<��&F���Dg�s����~�긡�S`�3C��oP�=F��F�$2%x{�.�H�ϛ�r�����~<�ĥ�)��F\��)��������||�5���?���UN9V!]����k�}��Ʃ���j\F�X\>�5'���_U�V���C��@&����}$�(Z�Ց��RP�P~[N��M��}��d +Sح��6 f&������� �7�4��Q� &} 5�6�"����\�l>�i�L��X�� m��������\����G�VP�������4R*|�i��/[��c���譃}k�r���y����,J�I"�8��:/I ��$�1��S/m-%\�P*�J.AF�W:�� 'dA�b�з���m����E�wU�]i�c$��-/��&w��jz�� [�D:D�e�{�H��_D%v����0C�&n�:Wm7r�;�%�t%g's���6�>�<B������Y���o��Dݖ�۬P���7��%ꔟ�z�"�ǡ7B�0�;���b�����2ïa'0�ےZ��n��i\�x��})�^Ye��wC�|*�K��XQ�ͩ�~�1't�b �D�T{�H\���Z~h�|J�ڒ��\�P�llZ�Ȁ�u&��',������;R��N�. ������?_Cb��ʔT ��#L%'`�&�*���Se�Pux �[jU �.����%:c��w�\%""�+�C���u��*�c̵�����D� �W��!����Q�*,�ފ�@�2D����#T3\n���[�(y���M%�3���b�d�]F���7ĺ±{�2�TqP��N�YSBWK�rϘٮ G��<��Qz:t\�c],��=����n+Ċ��%B�\xƜ1䟔�$���s��_�Һ����� byx�TVi����6�j��{�_�>�_w=1ڙ���rӞ} ��`/��k�YW�`v�a[n.��L�A p�k8������.c�DBeL�e���::�� O+Y���b3���*����M�mE�4 �`������l��Q�P�`��l1C��Cd8J�ek8(��d@�x$7y9SV虈���i:� 0z4�0���!�E���Ÿ8���5 ����|��þ��G�TG�����8�+���f�[A��1��S��R�:��*C���"�cly�@(�\D���^��RX~,��Ȧ~�Y��� 3�2�R�xҘ�=]<"le(�������������u�����/a�D�3I�?@]�VuԺ��j�� ɄU�^tn���B������<<Hߨ�ӓ�K�P���K�P\K�c�7:�ΦؖD8ٯ��8j�y#�D���O[_^P8�cP.[�%�w�sO����w�U�����4�$'�hd���B��Yg݁��������Llq�����������X��?�L36zJJ&Tl��b���(�� �Ķ9�X��E��>J:�����hp�����߂��%��LISc�(X�/Ѡ��e���AZ����.�<IpS���`�X,��e@U�:A�������Z^Kd����k�f~�k����U�Z,!�@��u�N"��+�(ݶ^C��!�tC�1Z��j�ˎJi���8[�\�H�Z)��ѣE(��|��m���Len�u+�L�b`ѱ��79��`�i���*��#�%��sI�=}�{FJ1���vY@o�1�P�g'��-�ٍ)��� ߧU����L�(7�02!Ϣv�B����C��m�U�^~�ꂦ�0�p�C�Ҿ)��W�&���xy���a:��S���F��sIh7 q���L��Bv�`ے����1G��<B�&�jty&�� �sl��˥{�Ԗ���a� �t�!1t�W�ӯ{�� �8�^�� �'0��;n����W�^כN3�J�4�x2�Q���%��*��B7+
Behavioral task
behavioral1
Sample
846fbdc95c3e528771ab8a756e362a9fffccabcd8ce8ed20dfd78d7599321681.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
846fbdc95c3e528771ab8a756e362a9fffccabcd8ce8ed20dfd78d7599321681.exe
Resource
win10v2004-20220901-en
General
-
Target
846fbdc95c3e528771ab8a756e362a9fffccabcd8ce8ed20dfd78d7599321681
-
Size
724KB
-
MD5
4346d34f22be71097db4e0209edbe4ea
-
SHA1
88493d0539ecfd6b4feba43d02c43b826dbffdc4
-
SHA256
846fbdc95c3e528771ab8a756e362a9fffccabcd8ce8ed20dfd78d7599321681
-
SHA512
82528baf8890484f2c0014348f7d87cf037ff65229226d9cf102f219e1427984c4409a341d4f8601adae13c38bc2a56e4e3f1770d1f83f5dd1bca62cccf3cb09
-
SSDEEP
12288:oIi3rr6xIiXdUDQrUFsXsmaT9v9rWGyakCfV+9bUNjWwWz1hAqFQxQC:oIivrifrrsx15GaV+1UNSV1hfFQxH
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
846fbdc95c3e528771ab8a756e362a9fffccabcd8ce8ed20dfd78d7599321681.exe windows x86
bcced469e65354473bde96b9ba460f9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord529
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 676KB - Virtual size: 675KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE