]�j���Nޜ{���>[n�:� �q����I_���}5�c�j9�6��2i�$PWD^�>�R�~��訫諷i�W�ϊ�c�JՍ8��pBG ʑ]ι���[q���L�9 ���Q�"u%n���m�£^}�1�yJ�Ո�G���\��L��ę8�#Dф!H�qЛ_רtK8��ښ�(1/m���.��1�#~��쳟6q+:o���`ة1ؓ��PS�J���H���Ժ�WV�_��|�*��8_1R�{���ҷ\!��m$�"�!�n�)��l:��+G*�@�h��Ö8[��Q������I�8rҰ�:��F�.lH�L{�f[S.�ۆ�� �ɠ��a��YU�QO��"�u3Q�����7W���.a�\�7F��hh؈GҮ����buy�v�x$�"����tF� lOc��N�;�moQ����!��+�Q���$m�k�7�e�oocm3�7�Ύns���4��c�zJ�^~��݇� ��I�>T�-���- ����� �M��E݅I�w:r�&���j���3k��>�g�ryk��]�n��c��u�������������"sA+��+�:M��^��^�T�x����8���0礽~�3. ��!���N\��L�;�DBF/��`t�i�L�I����ZnN�^s�-����Lh�`�C�5�Y�ʢ�L�Azv5�����4�o�����ւ�m��)*mu���I!yF\�@# �-S}��) � ��RH�Qi^ 0V���8!M-�\������J� �-�4��7��͜�Ŝf����+X������t'��d����H��^�#���9տ1��'�M����c�{�,���y;'�r�whm�O�e(�S��H0�����C�٦���}��C��j����C3�j~VY������,���ꗋ�����$������T(a�q*�Q�b���[b�\,��T�'���d���#�ϤrRRnx��l��SDի3�P/&x1����@L��+u�#�eErl_�:�{M����[��ɯOZOÕ����Ν+�q��|� YVF�f*ȎX�7Y ��-/��VI�U���7�!@���#��?�@b�Å����:2��rZ�VR��=��x��2+.�㴥5��궀���0�_�x0U�'0��TP����G� �d/\��;d����?�'00B�:���7���}�G�?�^��H��'�?w�'�� 6�JJ�l`��`��T� =M!oYaH�J��J��̈߮���5�*�����Ǩ�?���<����rV��錤+��_l�.���`�`s[懴�<E�xv����ҕ�χ���4a� �y�b� ��S��I�� %�%E\E%��rn$�Z�B�Ϧ��7&-ꂍ�n*s�� ��;�.��qVB2�c� K���ΙಝI��x��؇�`S���c,o�����|%?��sI(� ��+�*{J̈�C���) �q[Ah/�$6�� ̵�u~�(9W@��B/�.#�.~�y�C�~� �=�y�{�V���W����ȋf��EqXC\� Ym)x�c��+�5:T=M�1\�����s�1��M�����@���,|��C�����'�s:W�8���_;^8|���ʺG�^�!EC�XV�X�k{Je���>�))�N�f�;��m�<� D���7�B.>�)mD�ɯR/������^��ֱQ{�^�9�m^�#����K��)�a,j_&|D u���m� �P�)E�+�����=M��^��>Oo����E� �/����n�q��lu���|v�-�*j�%b�4��]ƕ��8�weQ���g���.5>�{~suH�ݶu�j��ð�EqR���|�D��h��P�Z��{�8Pp[���*�P�z�7�ܲl&I�y=�fL�5ճ8VZe���u����А�t�E�X���������-H�������t{B����m�3�ڄ�����u��h�����e�������Ŀ���hsTA��.�6{��r�����}FU̗N�:R�� c��ʏԨ7�"�[�_�����$� K�����`�t�߁�(����� io��y�7=�%��m�66�6�HM ������|�۪��5����ᧃ�˧0��V��ڥN�n�&tW#�Gـ�o�py����2M'����8A9#�He�xcM�o��C����}QN q��2��uaV�CͽQ�{~委_���w�k�����x�I��n�oQ�������[�!>' N͠(DD&��u�W��[96�P� ��d7>���A2'���`^W�9�5�`��qd$����]]� �#��VA���Y�Y�Y�H\�l�R�K�r+�a��������X�B6!ȼh���y���ݶ�Q{Վa vi���qg}����@�x�"���[��:���h��ᖞ�OJ�|Mb��~P��x KL#���mx���7X�!�Ԅ2@d�W���q�+� i�<���59��,���B�K`Ebm��-Cl|#P�ƚ&����#z��`E�@6�2�����hzi���B ��ѣ��#�n�,}4w�h}�+_�x�Z��d�/��H[y`Gi�p�S��i2u �ȑe��P�颏F��#�������_���,�ꢰ�d�vP&'�t���z��RbEQ��x<�,��h�p<����&����-� HO^$:m]�*I�y�}��@��H��� �E�(��d� ��V��1�̿s���!�aɒ��)u̓�e8='ӷ%U�BN�Ǿ����!d׃�сz��t4�FW��S]��o��?�ԎZ��tDؓ&i����X��.�+'�K��{H�����zmR?�j��Ob����DH��x��� t��L��ƺ��!̢:�N���R��p� 9����k�C'�>M��jrt������dwRAJ�!��U��(��Y_ԂH��&��MB>n�����ͼ��b9��� �;��n��x��!D���Uc*����Ps(�.�����+km�a��X�M��X2 ��ߊ�o�<��B��/N:��=m��4rB�jp")B�E�d���u�� �1c���V����Xp����͇�zן�K0�~��W��
Behavioral task
behavioral1
Sample
89dddc67db4fbfde0d5ac385cba5f461724b458597fcd05021ea08df66863fa0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
89dddc67db4fbfde0d5ac385cba5f461724b458597fcd05021ea08df66863fa0.exe
Resource
win10v2004-20221111-en
General
-
Target
89dddc67db4fbfde0d5ac385cba5f461724b458597fcd05021ea08df66863fa0
-
Size
728KB
-
MD5
dd5d8e7e2f56a4a51a55109d951b7156
-
SHA1
ed642774e27fc253d75e46183f5f658c0cb8afc7
-
SHA256
89dddc67db4fbfde0d5ac385cba5f461724b458597fcd05021ea08df66863fa0
-
SHA512
a4bba181684694806b90699ed95cb9faadf12c610494e64ab14b92853df7c3d5bde1b7375afc3c680adbb5be7066fb24a9ff2d242e6d8062db8995747c8b2357
-
SSDEEP
12288:gqf+2aBYcEgz8yQpGmbwqCptYzsw4NV6spb9OsvgQAF+PBMgGcGe7adAVtKSjrSa:gKnaBYcT8yKVCptG2V6stvglsBMgGcGg
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
89dddc67db4fbfde0d5ac385cba5f461724b458597fcd05021ea08df66863fa0.exe windows x86
1502892ff65cdf7a201cdebddc5a2061
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord670
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 680KB - Virtual size: 677KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE