��jv*v�����8��q�����a�[���=ڕ ��&Y|�z��}bm�'��{6r�L��&n�l�����$]i?�@8H�E�`0p#�7�H���'Y_�����J4���q*(�7�߈З��M\c��w���Dsw|�N=�ɟ�v��.#�h��q���PY9I3n� �7i��|}L�)�[�}¢��X��w~9 +w���p�E�(a���S��{!�x�`D!*@������/L��l���(����'jbA~o�f&��&S��BC��w�ޣG8Z����� �[fX$����go�2]�|#�p��Oxh,��'�ۆ`j�elx�fn�+13���<[�9�>�Gmٹ �X�}C���P��O��|r{M����c��P�l�^!�R�37��U��f�m���BB>��Q9/$�I-b�;B���+S�nj.0��P:v�-.>vI߷�b =����j�b��~'�C�I�h��L�T�����c�&#�^�������=���H.���������t��� �5����[��F���i�e;H4Jq�����;���f�D����O!��#Y���`���c�z*�|�����giY����F��7�y��H�����9��S,;f�XCA�#i!������[O�U3�'k�o�Y���@���<�6Y|�[6����Zt��(9z�JLi��I�$V��J��HG��'VH^���5z�]`�I��"�����-B��:��e>� �*΄3���ހ����=�NP�3�38s�E q��_E��5��{f��0֪�/L�>T��%Λ�_��2����gB�)�գ�~� T��Tչ/���i���u? h�r�FX��fh|�9d��Gȡ���?��������s����A7%o(�J~!5ӷ��ѷM���H$�������Y�%��&��ɉ��>��w�vk��%���a�'��Z����N��j�}��j������4;��V��6'�e��Ff�L��%��2@4ݶ�bE��5nxk+��?��$rҫ�C`�����Q(��P�n��ٮ��m����V��ENK��Z~�.��E��+/��;hX��߃}o�x��\|�!]����J�jwT�[���i_�Q���|�O�6gL��K���D�8(V���I=����L�ZT�[��������A��<i��QyQP�k�[�vp�o��3�����u����J��o�h�r���.WM� z]�\�5Of��ڹf�����d�t����� O��4��ˏ:ϲ�$h����s���<�`�v��rOW���K���gδ3�.Ʀ_�d��xbx��������Eb�h��Г�����Vs��G+��簕N�����C�\���%rO9����!�}�Q+G����RMe���.0�M��q� y�2O��BFrUD�%���r"���S^�'��N��B�rGKU�E>g����qKj!f�aF����M���떕=��O����,�j�o�d�"g�X����Mm�0�1��@3�8�9��?�����;-�N�HT@zI�cc@�!v�`�q6���/��&���}�8%����bS �"�Z�^��x��6�ղ��tE�qo������f��01� �m6���ۖ�A�&�0[6E�92/�0GlkD,}?78J�����g�G?�R}�ra��X)M��PR�@3�����y&� ����fv �3����k��n�G����2ᓀ��@�^即��O���}�q�w-�F 3��(x�������ۑu��n��ۂ��p���*�V??�"/Z��s��t&��#�� �_��́�i��V������|S��ܖn��mf@���2i�2Ig�sm �5}bdNa� ̼/.���E��[���7B3�o3td����� ��}9c}�[�B�߳/�k1ѯU�3�ss�q]�ηh��v�g����N8lp��j�^[�Qc�QmA��,2*��6�Jë���F��l�ј���'z��\᪸`ީr2W�p���C����8�9`� �IرG7�����B$��I������l���^�k��0Lݰn|��5�r��A����T��f��1V��nF���v_���]~�&�e�g��Q'2@V^-J��k�q_`S�Iu���Èy���fIU*d�l$�S3IؕLh��鿒!���@�i16����Ԓ̲���^�/�ɖ��SF��œ'o\K����G��,S���P×-�[�ᑿ�\ ����9�;f��3����RQ �Ԅ�o"�I��Ȕ]���*�v�X��B}�{ / �7�]̆N� �uzX~�)�1Xٌl�(Xl��\���%+n?>m�m�3���0���mL��(����^��d�~� �i���?����� (�w���A"��x�#)�c������{������y��?�o��xc�U~�Q��5����M?L<����kSt�f��������F���};�3OFǽ�H�_c�q�@�D��ee����E! �����FV��|'uH�J�m�8Fo��>�� S��b?.��:珫��� �ǑD�����L���`0u59��.�����p�a��P�7���L��3s�ܹ����W8#�����zӖ��v;�2u�m"C��h�0����'N�#�nl�"��o����t��;��Z��"つ2���P��|�C��J�UN?�߽�B���NK!6��+)����d|O�&���e_/��^8�����2���ь$R�ol������)�G�K���$9>0H�ջ����}9��@]R<��x#j)�"�f ��,U��0��6�y�EvÇ�.�[�������R���^3����g��ި.'�Kb�{^a���*�$�L� �r�Y��[�2��x0��s��z[+ä\�"���d7$X:�/�,X�tv��3-��;V�d�J��s~��K)ub���-�Ţ�>��1��Ș�S��F�RW��j{q��p`��;x�N`ܻ#?���q� �]��k�^�e�TD�� U6|���ax1�Vp��a��e����3���l]�۳��<�H�JQ�Χ|�Z$ �
Behavioral task
behavioral1
Sample
a13d3e97f2022588d321791785b694ea4a1582099449565495e2b4ce60d174c7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a13d3e97f2022588d321791785b694ea4a1582099449565495e2b4ce60d174c7.exe
Resource
win10v2004-20220812-en
General
-
Target
a13d3e97f2022588d321791785b694ea4a1582099449565495e2b4ce60d174c7
-
Size
232KB
-
MD5
b9c19f6ee7a2daab342ff5f205059519
-
SHA1
888b3b7fc902cced271cd976b45522b7d238ecbd
-
SHA256
a13d3e97f2022588d321791785b694ea4a1582099449565495e2b4ce60d174c7
-
SHA512
b4d59a41c6c04bdd92594f3535a205910ad261cd01dd20d28c029a717111828b948471b536832c9b0d4eb6497817597dd52f71f1bfc115ca89e9ecd378cc6d48
-
SSDEEP
3072:JmJxzJJwi4Y6w/V0tZK3pqht1X356+xxWZKRInWsI38ePr9JSaCHIN:gJrJwiN6w/V0vb38SaYIUvwI
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
a13d3e97f2022588d321791785b694ea4a1582099449565495e2b4ce60d174c7.exe windows x86
7cf368dedb4d8e3aa600f2a60a9ff9d5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
ExitProcess
CloseHandle
WriteFile
CreateFileA
WaitForSingleObject
CreateProcessA
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 816B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 338B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 220KB - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ