�G�����F`*sgD?<,��U[�@���k*�\! ��@:d�xY�� (��LE�d�q®����J�.���6��R�5!oHa���Ń���ֲaM��\���Y;�!�T|?��|��ը���pI+�BQb85�!�6�*]��B�3�U.�2&��i^�-[d��CVh���b�R�⇲�Hq�ߞ/�s�ziY���/2ĚG��(������hR6t��=w�UlY��ї�@��G���a��$��Ԡ�j�ݵ�8Nn�+��f�1J�S�8����ă�;�T��O���ފ�J�)�V��7��Ta���<;rr��U�3w?5�U�d�2r�`�F+b뵴�a�D����]�f0E�+�+�vA��G����n&��dOﶄ�ˑ�l���Y��$���B���Ñh��e�0��"�-9�{h�Lwa'�X��ٞ$H���F P)�C'_J-9^ j'�Z`�h���M�A��_7��!|Y�%)��A{k�!"�&, �<+�Y�9���d���\Q��t �_�d��o�d*oӼt�v��g�1N�G"fm�S�e�@XR>Ѳ;�K*�\�&����a[�Y�����6�����+$���M��?�Q��"�1)l���'Sh�9�T�(���߃��Y4����w��C���J�|>�dvZ�]�`Nl��1U�j�G�կ��ck �E�&���zwj�l�*�h�7��$�z[D��84���Fd��2�4[K�&�:��ͪ��[��N�4�-.� uh��C����j��i�\W >X>G��8/�hVXQr��G�$+����y�)���d��6�3*l�Y]���Z����� ����x��;ɶcԙ��D�Ѡ�����f�u����z���VC���(���g�^~�Iwڨ�����CRȭx ݾ�rq��h!t��>��z�wJ�?�A�z��{��J�=������qvL4����4����&�bL�E�˅���a,RK5�É�7��h%�#�_�lF�F���w#�.�^:�Ԋ4N �7w�����6��.$]@�wx�����m�t�휺��k� n�U��.������n}��;�?XƦ�H�ꐟ5X� ��7[K�.��b?�Yݐ��2"J��BZS�z�?�����4�J��*���ݧ!0���|��O�&�Ɍŗ�Ҧ��j{6(�7�P{)���b:���v�k�g�B���.�՝Pp1��1�LR����mt�?�6.(_ӗu��0g�� # `�o��An,�G���Xa�sB}�5��������vl[������U����H��ީ����^��L��W;����� 13���ᡍg��4��*m�`'Aʞ�1W'�c^{wK�^U9c?��f�7�Nm��k��� ��{�2h�9 ۂ�����#e�]�z\EҠ�1��J�I�#�W�*/�f����s�F�������ߩ�|�w����B�[P���&Z���l�:�����s�`�ںd�?�����v��%I��Df�|�@�ݤF�n��K5�WO��NƟJ�3i�j��ǝ&Y?8��Ă��cݮ�B>h|�*Fȟ0�������3��������LEg���z�rw�1��V*����`##K��q��K~Շ[�+�I@Q��1b��)�1mĹ��VN�v�h�m�w�G�מ����ل,�J�Q)Z�����x��e��<���bGS��'j��<̏7��dz���A�K�=p)�J�������':����/<` ![���_Z�Q�%M�E�kTijV�DZ������$Ko��:xxn�i�Tc� L9�Az+=���Of[��q�ʫ� ��bp�ƛ.0��|�=����������w�Os��[��L�~�~����ɖ�[���#�n�7�oy[�?\S j�65 ���S_�d�+ژ�f�~�����n�U��o5�N��e=�U�;�AQf%�a����A� �Y��.�ݧ�汆�X�����;������(��AY`f`Ri�,j���ٵ�ʙKr\:r�v*C�C��E6��;glV�!P��{�����'ZJ0D-�u*���!.�ٷ�a��]���C�h�ÿctҝ8>�e������A�Y5���/9Q���#Qv�m�k��)f��n�i]8�j��s3�I���Aw ��������.C��1�t��@��U`�ő�R���7����N�T���Ne��B���ؐ��P�~Tݜ������f�������~')�����9�At�:[�҇v<�Y�<��Fp�U�>��2$��=����12�������0I��o1�e~��D,lJ`�:S�#��1*у'�>)����O_dG���2$��D�M�h ;����U2�`�b���u�uW/wTJ��2�����j�����c�r2П��F��g(hZJ�*� �(Rd���y����1/8��P{�hmb�J �����q�R+ bZrJ�ґ��Sv��4�c������uwk��̘��`����Ubon�C����ʨ/��h�͠�U�=ڿ���3Zm� �8������\�ѐ�bwJҋ�c�`���x�9!#V���qY�͡my���P��<���������R�e�:)� �r�u�b^a���_�U!L��9�4�D��XxW"+|��� n]�u�ޑ�$9r"j�z����SwXnh�s��� !���G��$��|���+գ��#��3��q��n.�xL\r��<�����|���TŶ�0��Z�>s0ܒ�vȧ��|@��A��&y�U���Qc��R�9�� [}aM]�3P_��\����IP��+Y�?bp�٦��=����7���^Xf9��<8� ����t$�Jk�x5"A�%�"z��}�xSf��������$� ^r~�T�bT����X�_;��� O��H���;+�U�XI��;Z��s�����0�[�Vq렗Qt�H.���.sQ�����z{m`C��`6{|��WpH�z���$_�5�R>L�c��`�����G{h�7��,�fZ�����T����7���E�JJ���x�H1��x����z0 �l����@ļ�l�cO����� ���4�5�}���I.�yJ�6Ĝѐy5FJD�ܺ�1��[���m`T����Q���6U }n�
Behavioral task
behavioral1
Sample
ae63fa967d0960c45a9cf64b7a852a90b9686dfea2bc7284516dc2aab8086a69.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ae63fa967d0960c45a9cf64b7a852a90b9686dfea2bc7284516dc2aab8086a69.exe
Resource
win10v2004-20220812-en
General
-
Target
ae63fa967d0960c45a9cf64b7a852a90b9686dfea2bc7284516dc2aab8086a69
-
Size
381KB
-
MD5
fc6dcc29531ad2b8d48b5e22f17ac899
-
SHA1
0b81832697f5b026c6520d717897618306157cf3
-
SHA256
ae63fa967d0960c45a9cf64b7a852a90b9686dfea2bc7284516dc2aab8086a69
-
SHA512
8c975984e4017adcbc25139a270d07ef8d7eb18094d5dd024b35785f4c46af5510eea18ac7d0483cf3d9af0c4ba47ab1c3d5266cb87554e776ad03a1dc5a4382
-
SSDEEP
6144:jutCbpkXL1uh6Ws3+MaGeNzevPAmUDDCF2vGCAj7rsbOmaVo9UXkBe9KuvFeN:CupkbGs+dQHvUvzTHqVGUXkWKw8
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ae63fa967d0960c45a9cf64b7a852a90b9686dfea2bc7284516dc2aab8086a69.exe windows x86
db510e12b1d6e5eab29e17829c716a80
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
mfc42
ord2297
msvcrt
_setmbcp
user32
GetThreadDesktop
MessageBoxA
gdi32
CreateDCA
comdlg32
GetOpenFileNameA
shell32
SHGetFileInfoA
comctl32
ImageList_ReplaceIcon
ole32
CoInitialize
avifil32
AVIFileOpenA
ws2_32
gethostname
Exports
Exports
Sections
.NetBot Size: - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NetBot Size: 310KB - Virtual size: 312KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NetBot Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE