��S��;U Q�hϟ-0ί<p0�ܔ�L���g�z� ��[W+֛���1���g�.dGI���G�>CR�Ҏ=��������Za���V�A��[K���Iq��3�]r��>k��ȼ֬+%Ǫb0�,���%����+zjg�h�����u���`���2UDT��,�*$�/X��X��7O����4�ci(=Bn���]�=S��3[< ��@f���zXi����Q��k�s���FQ'�e��vx�A��'��P$��3�DIJz���'��@{��MP�vJ��C�9�LO�5�gI���Ԓz��u/�v�`�Х���k����F�I��u��e�{zѠ��ţ�U�~���n�Dbiwc���O�������&"Gm0A��?����A��#�>�6g���yP\�|Iʩ�l��m���m�a��S�=>���Ttٌ���y��^y|�n�0Ԉk^�Fsy�ܴu���z��o��ݺbm����-C�%�`����8����2wf�T��U���Ni�E�x��^t�����P�%Si������8���� [H�Hq�Iv;D���1)ôvT�^Q�ȒL��Sf~��� KX紽:vO��ްP����/��-��Z��W�� ��+.%�/�wk�!Z�L�9cף,�x'��u�)�=(fQ���/ m�3x"��7�B+,��i�sנT5$HWQq`��b�� �fr��Y˦UB���Y�$�.�Qc(�l�/�O�Dpv Ώ�I�L֧��2� 0��d�ӵ�#���y;j�WM=<\d�i�fqK1��]�T�!�qWD��4÷̝` L��P�V[�Е|���bpĽl�c3�&��֤��L�c���i�S���2����Ȁ݁��w�.��α� R�N C��Xq�9wq��֬F���ζa��e̢��K����H:O���!~F��~��np���쓕�� a�.*zPg�)�U�ͤN�=u<�q&��$�����PziQ\��Z�M(�ZJ�ă8H}!��b�&��i�����k|V�z�Z�4�^�L� }x�}W�����$���"`��G��O�U�r`��;���g�4�L�(��l������o��[]2�nޡS�-["O��Q�$��P��Sć���N��/N��fr�v��J�PvW ��٨"(�ɧ� �%���6��m;,*��4d�zƼQIp���ia��{�C����ݻ�s�[�1�Ͱ�3�!��m9��Q�Ɏ-��d~�ae�����.q �IŧwxM._� �KE+�jE���ė�4�8����Q3N!fy��%�F?������K<61@�V�:5V*�A�P�M~Wl|8ge�㣄��F����t�����t��W����a��V�mP?g!���?b��/mLn���� �zzOF��B�K�\Xx�bFU<o�O�qQ����X�c,7w1�A��!. ��ʞM�:`��oZ�f[һ�ˀ�4�5�<J9�q���rK��������t��۸%Y#�Ju ��8�U��B�&;�N��6.�Y^-�.q�Nȧx��-j^����M���%����������*�䶽c<F�0xՄ�7=���>������,.���+8��t�_Œ n��v�]����}� .�i}���%R��� �0 ����X})�B,Ü�C,v�bm���Ԫ���'�[iXb�B��/E���{��F�i����6n����J�Z{��;2�ѩ��-���w�q��V`!u�M����x�j�/�(6H/R�e����h��������T+ŋ⦆���P�m�H�(v�L*�3{��l��Wo�1�6 J���፦����,��N��`�jj��|�{sW��:ܡ��[T@eE���fKf�2䱟XRG�Y%�3[~XT�{W)�e�f���#�k|y&��=T��X5&�b�2}��E���.�)��5R���G��y>p�{v�&�M������=zc�e'���CzC����n�yf�����5:��JbS��_�-~3m����}���t�R���V��aG�Vý%��O��z嵁|ػ�� �:��)����i`�>I�Β�TON� �f����~3�~�XO�gx1��^"#�]Ĵu�Q���B[SD��fz�ěR{������I��XÊ6��$�d����,+������|�owY~r�*�ʗ���o�EBrk�v���]�)#�pFw�ҩuu����_�̎բj�)�n)��_õt�����V��g Vp�(#�iPi�C/v��F%��ݺ��$qЮ!5�Ã�N�q��{�8�<Ȉ�Xq)����^�h�!��8C���=K�'Y��ba%�µ >(��ٞX=�)���,6�[d�^^��]�G�;�p��e�USV�d�3&��a��ˉ9�:�^��M쇉���e��v�~�n�����4y.���Q$��6'ssp�<������.�&� f��V�GT�W@�pG�Քէ,[h5�.a�6�9E $�+�r�?���_9\=y:��������% l�w�)���#!��/H~�[~�&�&�w {dc܉���?��J�d�Ֆ +��7.P����*�,V��?�N ���S�DC�ʼ.�Hn�R�K,� �P�I���\n�-Gb"��1E�G��&��1��M������Q�ma�k�k��D���Z�Q�_����_�+�3K�>�)�(�g]��<S�L��P^W[�[�[:������h�+��`�9�Ն�l�� ���`y��/b�j\a-�������,#�HpMg�d����ɧH��s=u�=����R�@ζ$$�&^����ET��#�������Q..������� �aҡ�E7,Na���0� -��֟����Ú��n�Co<��ݟ+����Ie }��3���0ӵ�6?[N�^�q��M��r�q�^����E�;���H`�e�V\��"u8�,擏� "Qqˌ����D����Ȅ%(b?ߒ~>�Bف��T`Do6�Fǰ��X��T�9�#����A��/��1����}Em� ���� �u�c�<��;�g.�ܾ�OD�t��3��aX�J
Behavioral task
behavioral1
Sample
bc1cf10f31dd61adc40e1a911ef1bf75c712f93437d81e0cf2207bc8999032d9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bc1cf10f31dd61adc40e1a911ef1bf75c712f93437d81e0cf2207bc8999032d9.exe
Resource
win10v2004-20220812-en
General
-
Target
bc1cf10f31dd61adc40e1a911ef1bf75c712f93437d81e0cf2207bc8999032d9
-
Size
728KB
-
MD5
a0458c9af8000b51a5398dc89f4d8ca3
-
SHA1
58053d9e0007dee6822d16d49a2c89b68d460274
-
SHA256
bc1cf10f31dd61adc40e1a911ef1bf75c712f93437d81e0cf2207bc8999032d9
-
SHA512
16ee6d1eb3a873086b820e33b921ca29a9cc0f16f863dd5739db6315a70ee1ae01e544bcf71f4e9f9a67801204120b88e8f1853d9283bbc371499d0d7678a53f
-
SSDEEP
12288:yPES5vGEtvEoSKC33/y01WF88wzG5i5C9HTsfcIAwKZFl+zqkz:yPn1vRZcIF43Q9H0cIF
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
bc1cf10f31dd61adc40e1a911ef1bf75c712f93437d81e0cf2207bc8999032d9.exe windows x86
003820dbecf318c5e693983f93fe1dc2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord581
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 680KB - Virtual size: 678KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE