`��q�~�1���_��G>��#�����d�^�_˗X������>���{�ʩ��I�݄ ���xs�4)�e���{�����wP#7���Uχ�Jd|)Zp�͋�ZfY�l���J��b�6�:YK��,t�|��Cd����3RNK��/އܙe�+�b�c�! �R�R����m5ª�7�ڸ��@�>b�$c�*�f����+{��$��i��ឞ�d{����}�w8�]����sAq�{tc�X'�*��|?�?�k{��_�V�~��]w_y�o��"X�S�K��G���̭�|�u�MZ*��T.2�����p��V�E[���:��Ai�7�T$j?Ĭr?��t���� ���m�V��^X`�rr��Vè�/�K����W���dI-��y��yh1��P�fio�6�qA�ӛ�>6��_��ɑ�4Hτ�dw%��F��gBYɸ��%չ_�# �]�^鯥���F3#�8͚݊�9$��PpG�fOʃ=�l ��V �9��0�P�Ǚ�1�I���8i�λ?��u>�;�Qք������t+��h�6A�v�p����Ϻն�ۊga�a;(@Ha)�wU!�'YS�M�����T�a��������.��������/�&�V�H�?e�E��"NmT8ù��:������s���r�M�+s�������/<0��#�KK�N}��k�7=��� QՉ?�j�؊.��������T.�qv�Ӈ�Ճ���S���H�T���Q���{���O��!2"� kt8=k�1u�ń���UDˌ�uY~�:%��4�kb�� �,�![ɒ-�<���ɪm��'�p��%�C��~�¤��b�?WG�8(�W�yo��.��)+�~��q>�-�{����R����Xy�4FF1 ��s1�b7^u}���K���e�t����@%���c�iF�z��������i��-GNo�_�$�L��tvU'T��vJ�Ϯ��dVU�)! ���q�8(��]y����_tWD6�����t�(U3�����x�h���W�����JK��Dޞ����}���#rQ���7+�o.�s7�̳;^��K�=�|�I=%�I�땚>�>����|��i$� ���"3^��y�]��x;��uQ�����A ?�Q��4�[sGI���� ?�B5�c#�ZS �����g��,(�X��Iw���h@�(X�'�\Ks^�7\j�L��B��b�!�J�[��l��x𪽇��G����g];��a*�����B�#��_�l� �ێ%���p��%W���k��Q��C%F�x�/�ӵ� M��z�p����3w!j�DN����2S����>������^�m���ygFub��(}"�7P=`����D��j�"c7i�W�_������T- *$�p���E4���<�m���L�oEYӷ���7�~V۫�^��"#��f16��T�x&B�c%���CK^�5�Z��m�������>������]�ҍ\��ҡ�{�%JV�8�]_+`��K�j'�� =�C5(Ą1}��j�+I��ym8.D<���8u ?Pu`�<�HqY��� �U��.@:���PJ�A��S���"I�9r�el�G$I�36)�k>\���7��ivhZ�v ��d=�f���+*F���`��>�^g�c�A���Z#��4=���z���tS���-����j�)����o�2:ʸQQ �Z��s��X®|���j����_�o�^c��Z��ԛ��£�XY9�p��CH�YF��P��\���~�^u{�b_���0$ 01�Djh]r` �faʷsǟm��[b!g��>��h>�F�b; �h��7�9jV|!��<�G͓�d��O�#;G:|��j�����- Oh��$k~�L�F�3�υ�p�k��pNs�_��a�����P4������\%�V�-1^?lExVS�=!b���keQ�m��P����B��%��#�K$���o���з媹���;�;���m�K�j ��g��5�U �ъy!w?��\���^���GC�$+:�e Y���OMD��5���eN�3�I+���J�_�Pi��q�9|�]�eۧr�@A�rM ��,u��1(֖�� �IV [��H(��8�(��vV����D�=�l����Ҥ����kp�u�f��ƻ?���rM�ծ��PF_���nF����0s�@�NB�ij�B�ۜ���d��.#Т:�ЋI����A�g�l���Z���0�5�L� b�}�:`�ᢲ9���X����y��'��]���X,�wt�݂ԓ�ҨVs�( U�}߈"=S�ht�~Y F��\�(��@Y���g���N���E��I zI�$��MYZ_H�=�[���x=.����@%Up���u�b�^���@�˞��^����h#�����&�GPz�0��"F`���)Ȳ���Ӧ�m��`p���F��2�T ���Z�f;HcSfR�? 'F?�l��5z�� +K��QQ������ś�0!�D� J����������ܘ˯�3<���U��h.q ��t9�{���5� ֞PF��k�l1sbO�ޮ�g�����L9��b��T�iPL��A�����Q��b��[M�"�����5����c�kw+ ���q�> [s�.2�OYc��H����������x��h:;ո�U��9�j�%>���^�)x ��:��U��Fp���"ǹ�N���U4CV;���_�#�\��N���i��n�F#�Y�Ǒ\O�l�$�!�:�[�U���i=|k��� r,�*3���"��2�'�YJ*��/������/�QA�G���qۗ���p"�[�ߦw���D�Z�dA���t�Ĭ0�C� �H� �,��c�4��Mr�b�����l3t�G�e��cJ���+�E;�Q�yM5�`�k���P�����\z�ӔrH�ve�B�RW���� �H�h �v�a����Ae�4 :����m30���N�Xb���mTY_�C~�F�M�)�T�<8+��}��}3�:L�^K��pwJ���vd��)�P��&�7�(�*����~�8��omnaj�8��551ݡ
Behavioral task
behavioral1
Sample
98726e59a9d91d1cf764e1f0ee4546e2068463674385fe94bb157a30d2d2293c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
98726e59a9d91d1cf764e1f0ee4546e2068463674385fe94bb157a30d2d2293c.exe
Resource
win10v2004-20220812-en
General
-
Target
98726e59a9d91d1cf764e1f0ee4546e2068463674385fe94bb157a30d2d2293c
-
Size
660KB
-
MD5
764ccc36cd3ae8903f76f1ad2850f953
-
SHA1
5e641e041f430108c77ecb3f1f060c93fde84942
-
SHA256
98726e59a9d91d1cf764e1f0ee4546e2068463674385fe94bb157a30d2d2293c
-
SHA512
1dbcb37ee5e0468a11afbf96f2a29ee7e43834ab5de77d09e136ff2c22bc19497cd134d6724402d29de8816abc1fe357612d06c1631ae9aa63e25c8d794b839e
-
SSDEEP
12288:ZAxtD6kRXg/6IR9Lhxru+Y0xhD44kuq+Zq1WqNDh0eytyLYrFArC5:ZwTdgyOLXu+Y0xd44kupxqloykrFA25
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
98726e59a9d91d1cf764e1f0ee4546e2068463674385fe94bb157a30d2d2293c.exe windows x86
98e231c60cc010f156718e8e3f314e66
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord531
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 629KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 435KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 644KB - Virtual size: 642KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE