�:o6��*�%�$5��۩�fwJ0�=\gCA�8��� ��l�T��d2r)@z�X�g@!1j�+cz��=��,�hn�L?$/�$�n���V��H��3e�� ����l����9���SGG#t��^����xʵ�v�����g&��d�e��!�o���q��'k��|ǣ�L*cE���\g�(.���3�(��M_��y�G�ۺ���a֮��L�;PDK�9�l'�r����K�4 + 9 �����+����%>\z�����A�Ok{h�Gn�cm����9��!ω�˓�W,K5͘pN���L۸��bp@��}cl��y�+~�lA��;�9�(�d' ���{�aa/��m�k=��|C��: /}Eh�|@�;kǤh�8>�|�c�=T�Jݑ�����w&Y5�6�����b��n�œܑ�X<�꤀Z�m��j���'K�q�����-V]�Hq@zx���ty����R��L��O��2.|������s�nZ.����!|<����I���[���PCXw{ś���)d}�C��3��%�=�9�!|�S�0��AL�i� �7��� S��M�+��Gn2@�#�,�/��@�h�4��B�X>N���jk�7Ne6���FJ����ֳ4[%S�Q?�t͎�2�O���ٞ�N�[2���6g]��$%ȡV�o�����O�kc�2WW��`V۔e��^�a�H[����x����B���9�H��Y/R{x�2��"o��i�Z�h)B\����������(ՅЇ�['��*�l���Eci�@��H/\@��O,dh��S���1�&6�pb���GC���H�(���� �Y�p%�C��"-0�'#%�D�N�&ˢ�vY��.�����j����Q���ւ��4�a*�P}�ʼnt�ƽgS19Dא���B�oOC�=���M�y����0S]��8�S{ W�5��=>Μ݄j��oV�$W$�9W+��cz��|��v��M�pj��7�={[�����K��F�)Z�o c�O̺ty����t,��+p���p�0�1OȤ�p_C3f� ��p�g2��J_ îWS��ߚj�\{d�V~(<�u��,�㊜|Ho���bbTD2?�rz��c�l0δ��Q^�����Gֻl��,��A7����wP�q��+j5�/cC��P��D�ͻ�A95GT���5w�'��zZ�i�!�U�-E���Q�㪮��H�mݨG-���W#W�qt2a���t��2_�o��gJ���v@2 e��h8�$�#�݉`}I�ζ��U_υ`��D����PY���S�������'i�tx��Iz���-���)�@��<֨ƙ���]�A垓�6l�5�m:s<����6�e4��Hj�¢A�=[��vr) `�ܢQ�fY[hh~�y��%!���9[v{�\e��Z�S�� 8�n��yʔ;���Zi�D�וֹ���=����-�px��(F�WE�$��I-��ɬv�sM1���(��d[0����B�lnn[I8D����/�'wG Rh:��B��(f[?$�7[)^��0�>������¯��ˉW[7�3=�*Rk�$Ĩ\�,�]��8s��p X�^L�c^@����t�����L����5�|� �>�T���RW���>�Y�vZ)��$_�~���5(��đ^���ZSF�/���%A邕���'�B ߒj��E�wn}���\_?:�DY����M��q�w=�yO9�GZ�v���`��y��V>+�-ߎ���}���M�V����c��Ȥy���1x�&�M����(W�2ɄJ�R���m/����[DZRf�ڻD"}70zx3����x�]��F��i���V%Сo�kr�'1&�J��;"���\��(��g���s!sa��Ȟ���h�¿s�Ѭr��ψ^�{�WXf.`wT���,�'�/濶Q՛�^�L=�f����]�۷��]XҢ�����ĊH�� ���0��;�4KH��Y% r[q�bx��xA��W�O������5b�6\��v�G�j���m�S�e�U�<�c��s�j�)�pm�-ε��dR=��P�mM���K]`��˷~߰�Mʯ�X��g�x�{4����1���9�����{Z.ari�����t3_90㭺^�7����uze�h���ȃ��ۘ(��E�]�@��f;$��1D_�R(���sN��GZ�)���<Z(~�dy)6Rۺ8�xiQ�@�}��������q��<(c�o )����bZ�� xɔ�8�ceԅ�C����-c�(3�:j&6���Y�5l�0����v>A��B�z�C��wA+@�{yk� �2b%��/g��D�d]p�0t��!��Z��J_��28a���5"�:cD���A�0 �6�ntθn�7��H:*+ m4�!������A���Vɂl��K�Qఅ����lӐ����# �;�����~e-4Fц9jdj��ԭ,��@������k�뤦oc�����]-ڻ�6�9v����Z{"������{�T�5ҙ�wj��MsAc�`����J�o�Ov̓��,�c렆�V���X��1��IAl�zn��w����O�(��o+�[���O�T�*k��z欣���H�VvA�� נ�=Nv�{n=�w൧��(�W����M!��ݶu��di��ȴR���7�f�,�f� OL��&oE�W"��m��簯���T��+6��� �;)s*�p��Ӵ�E�����\�{�*g. "X�7V�c�����*�V��;x����P���`[��8#)'4��N��A�*`��� T3��q)�1l}��y����w�3 �RA�p��I�h�{��zM���4\�xJ:�+�ū���n��B��kԟ�X'�C�y����A���㦮�{g��;syLf{=�2���mӰez�i����9®���I _�'��/у���=����7�v��4��">er������I٥)��ke�g��d��z~�2�IX|��K�`���XĈ��ͪLo�<�V~�pͯeս��s���c�y��F�I�� ��.s+ ���XD���P���[��o*���G�d�/=�W�6�Q:v�a�g
Behavioral task
behavioral1
Sample
b9aabd0b33bd2bef7669730a9c3a0d84f9ff9382ea86d1c1b7a40cccb33c3fac.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b9aabd0b33bd2bef7669730a9c3a0d84f9ff9382ea86d1c1b7a40cccb33c3fac.exe
Resource
win10v2004-20221111-en
General
-
Target
b9aabd0b33bd2bef7669730a9c3a0d84f9ff9382ea86d1c1b7a40cccb33c3fac
-
Size
208KB
-
MD5
4ee61ecea8d576cfdac1af061bb6b5bb
-
SHA1
b8f5d767564251a6209b25310f03b00a0b7dd731
-
SHA256
b9aabd0b33bd2bef7669730a9c3a0d84f9ff9382ea86d1c1b7a40cccb33c3fac
-
SHA512
5efeea55ea874bd897771e1b61263f1e385757b94e00f1ca301281a5dea658e3cf099a974cf634b0ff2b60ff4102d910833fd9f65cc073d43c6103665a46be57
-
SSDEEP
6144:PPfEcq1vJ42NCPbojQOGZgGdefoTmHPoFP1W:Hfzq1v624+EZbaHyP1
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
b9aabd0b33bd2bef7669730a9c3a0d84f9ff9382ea86d1c1b7a40cccb33c3fac.exe windows x86
7cf368dedb4d8e3aa600f2a60a9ff9d5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
ExitProcess
CloseHandle
WriteFile
CreateFileA
WaitForSingleObject
CreateProcessA
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 816B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 338B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 196KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ