�OLr�<p!�b�}B+G��L8�m���ɺtw�m=�_�}<��/ܞr=+�n'��]�J������z�n�����_�2��N$�S`= �]��!�u�N�t[0Q�Ӕ�_�nű;���8|�������7ŝ^63턟&ɴES�e�ɵ�@�!C YD���E{��L:H<`z��@&�X�ӚN�҇D:Ȣ�[��[1t�V���#h�I/��HU<� �$B#���U˵�H�;Лd��0Z�6eI���ti���߀%,^�EX�-d!Nd�9tqF�܄6e���lu(���������B�dz�=ŵ��@�4��(|v����U��b.�Q�ń�7�No���GQ�-\�VM'Ov �O�O�iõ���5V��>�%[���_I�;sg�����m|)��17|b٬RƄs@�@�2��x����e��է��V2dgο �w����pZ�J/��&z���K��_vp,0U����� �r��lj�%V��S ���D�T�TQ2�Bl��"�!�N�ˉ������u��!����Ӈ�'B���5x0���;����eVI��[������P=���� ��z���LȘ���PNgTy�&*��� .�@�Y�n��f�����m�8�FX&,���:إ� [�8$�ZH�q�9���IJ��8�.S��iڅ�4���d�rR��`���M� �wm�y[íf�i=�คA��'��nK�UUj2�@�h����]X�_��*�cm��;��3.'�Fb��+�_�mė�J�FR�Q�8Y$�u�DK�u�_/���Mu���S�~�k6�ȒWK���%��2֧\(����'��Ӡ�2�R[ָ��*���>�i$щ��=.��gM��x;�a>�3�W �T��!�u HX��F4s?�ݲp���ůZ*g�gQ^�����>�9!Ш ��j��|E�a���"V�8��U��f��×"�����s�h��b(W��[���mb�Q �V��cB��y�^d��2R��8{IZW��}$���*N��2� 6���#�7`��1��(]kپ�`�Xn��[6^�^�\�w���Ю�Aof��.�Z�ڕO;c{�Vε����˹j������b�����z*�(��u=ߚC��j,�����������c�:]��hm�c[ ��� P���u���dY+�������{��)ckZ�'l0�ߺl���~n�!t�����I5��A���_�됴8; -�9�W��jG��nf���Q��a�Q}!���2���7=����Q�h�vPx h$���.���M��CS'��҈c������UO�|�m�f��` ��hW�t/,��C����1�����`rG���H�.!D��婁b���X��g�$-�E�O%��C����2'.5X�r9���d��\��GI'�E"�T�佞?4fT�T�3L+��e(�� CԡZuͧ�8#vS�2�ݏ�� ��C&��ѫzb�9���"M����V��2����S�k��������<a��#���0 v�Q~L����-2ue<��/��P��<��pƆ`�����XYW�)��� o@5;h־ux�����S��h���/-��s]LU����y>*��c��|ܗ&�©#w��u]")D=>��lP(�.-�;V(��f�e���s4��x�e��s�{�W �+w�Sm��O�|���b�ɋ�Ԩ>cB\g'*�� ���1���g(�k>�a��5#0b)�{7�_�?�4)3G �Ʃl������tS��4�M� >7��4ax���˔�:��.�(� F����$/�A��Y��,��InfOH!4u�'��M���,�Պh�Q�%k�j-�j�Jݏ"���K�0�N��ٖ"�0f��`Q��i��#2��M^ ��|+H�CiX\���f���v'����c:��Uֹsu!���/i.c���0�(��DQ����S�h��ԉu�F���N�,�>�.pK����(I�����i���P�WZ��n:�D������&E¶��p����� ���S�*�퐏���D�e�&�CC�OL�]k�e�-Ȁi:��Q��%L��s "mdVꡏM�JF^C����Ty�/�"�y[�y9m\��ݲ�CR�Z����3(�@A���+�����/�C���ߓ��rϮ�t0R>��˼�*�X�#�V༩�婈9;�� j�tI�I=������jf���Bf4!��u�V⏟�Ƽ����`��8��$<A����%�"��F�EX-zk&Ή�Z��Sd#Ǚ�{ X���Q^�<�6@�z�)K�! �ȋ����.ϳLj|<Z�֒���I���@��� 着���6�M���A� $�%&��-�R�;�z�� �s;����Z%���P����ozBO���VA݅��O-[���d�j�4*�b��n��:��p� ����y�J9<�Bɮ�����c�f��4����sѴҭ�6&o�˜���#��@+)���Im�rv<�����B�N���e�Pszjy�)��!i�&ZvH��k�� �h)s��8����7��4.��5[l�[�'C�������<�%�3D���!MV'���F���,fo����*��~Pj�@�'e�s�ǣ���w%@�ܥ�1��S)����p1���4OG��堉߮�� p2�'3o�YC9�ɀ��P�a�����Ȓ z���V���Gw,\�2� �&7�<��T������D�f.��,��NrfX:t�����$��z�>�d�MLZ/A�7ŕP�$�X�.W<�jZ�͋���� ���c[<��ب�|�� ��=%݈���Y�C���l�2�=+J��v��ZB�:��) �, �BG��j[^�u�\�/@ @�Ьt�^��}����1>��Qb3��� �ۯ��C#1��[jH��j�1Gg�l���%��*�U$A�8�It��9+�4���,|��,2��v�d6��� GL����[Fd�?O�} <��y?��FQ����զk�����m�G>k*�]�G�k���O�0g˷�q?���N_`�\b,��{}��S�.���]�8���
Behavioral task
behavioral1
Sample
18515b652f4be40061b4978a21cd9c02899210b2e3e9bef6a8345952efdb5e4f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
18515b652f4be40061b4978a21cd9c02899210b2e3e9bef6a8345952efdb5e4f.exe
Resource
win10v2004-20220901-en
General
-
Target
18515b652f4be40061b4978a21cd9c02899210b2e3e9bef6a8345952efdb5e4f
-
Size
724KB
-
MD5
2ff8a7f876f331619320a3d1f43fec00
-
SHA1
efbc072f7f8865c8f7af9823e9a088da4f42e849
-
SHA256
18515b652f4be40061b4978a21cd9c02899210b2e3e9bef6a8345952efdb5e4f
-
SHA512
7b7ba634f51a31d211af2502b0c0567af5514eec5ce7f5cce3a93507218f66fa431dbafb1aab74dcd269f50bf8aa1d52bae78f2304ef9ec3368cb6c273383aa3
-
SSDEEP
12288:Jpz1bpAvyTnIL//wgIFltBMV5Q1ncenxWzE1m2KLb6UfXg:J99px7ID/wNBMV5scenAE1DKLOUfQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
18515b652f4be40061b4978a21cd9c02899210b2e3e9bef6a8345952efdb5e4f.exe windows x86
03a76559953edbcfa48a613bd0211a1c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord569
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 676KB - Virtual size: 673KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE