z ����8��)X.���QW�M(t���(2t��x�1H��/�tmJӡ�z��!�tb�5�am^��QL7}^�>p�Zu0�$uph�ԑnXr���Wݥ`^I?�<��HAJ��k{+4E�6���<��� z�*7������cXl��]� ��߳���m���Hh$�n��y���#�qV�R�yLu�o��p����Dg�I�-����D�y���ah�gj�3!���f*��wx�*O����(y� r_�Ķ�Artoòl�ܭՐ��}���쮕e�3U�Ö e?�&��/¯���aK97�Bkj*4+�C}��헨�Rpֶ��ĝ�<����-đ������@$�7�7Qt����t��} �<1��R���NaF^�_/ R�z.hLZ�x���]�!�|���"�r4��������S�^���Z`�F�;��Bk��X"�M�ʹ��G�=�#fw���]-�-�,��0��/�aT�K-����K��M���%��KO.]Xq|�eMC)��gZK��/ZP��O�=f?ϔ�9���A��Q�P���ץ&��_��t����� �p�?��1���I �>w�UL�$댹0�)ơ���@���gh�&�}/�oq s#d�JY�G��+���Z/�= '�z%,��eԺ��h����l��C/���X;A������w7VsX�ݾ���~���gJ�D���1#q�m��U�x�=묿Öӓ�;9���´&���l��ύ��k^�ڗ��\����_�F���`�Yb'����^j3GlDC�e]f��4NuT�r�/J}��i;�"n>��#��Ό'�V�2&�G�$��D$��6f���Sĩ�Q+�#��-��x8gܥ! V���#�Z�M�i2�8E����Ar5L-��J��6�hy�i5R_� r����T��E��e���"��h���'_!�=*P3�뮸�.�����nՂ�4�,�a���ȅ�G\t� �Q��f�I���Z+�`s�g��Z��8j�tƘ���#a�G议��:�G5�k�h�OW�Y0=`�wk����U���*�]��&Oy?��ww�l����9�����q��,��=��wf�ȡ���w�/>�Tb$�����l���[��vfV���Ad��Vm�"����+�ÐK~���vrY���w�(�������Uր����%��Ě�`a 8l�ok��1eF5�H�ϼ��vع*�g���B�������m��+z�;��P�gpc���S�)H(��,�F����!�����p~���f���+��1(b\S��[���A`5�@z�>h�`�+��ɌO{U�W1ҳf+�)���!��6��Gq�S8"n��d���/1J�g�.\.#��H���2y��o`����BQ���r��t��lC� J¢GOz��_X�[���g-7��'~���v[�](�t��d�M��͏W&}�4>�8���CW2���eUk+h#���P�Tu���S]� �_ _�� bp�X��P��8=��j3���R�e�`a@>̔�PO��M�����j�= 9��դ��Ӿ�N6A�^�����R�`������vZ��}lS�bہ�8D;g�ΓNrt�[j���S�����N��� ����4Y\�B�"s�|j�dz�t"�I�������pPȏ�j7�#ʢ;��2*G����r�n}�T�߬�%��s��՜�v���">�~�?�<��QV���'^a�%�7��Aq���Ҝ��?�<ߪWZ���W��a�Cʍ�]� 82��r{!E��K���[��ێ�:2���=��Ã��M���GZx(��ɱ�-�[g��q;&�Ku�|� <̭c�w�}p�^�����R]lm��nش�[�e�@��c��7��u�QR;ݿo)�*_i�(pm���D�ec8��P����?n�S�颺�}z�����ߝB�)Eelʟ���3r�JC�Paw�\���ʬA�^�D�7�=��Lj���aQ�[�ݘ����dp��/XY�f/F�k�;�42�����|���U�����B���������,-@��>p$�F�\��˧I��� [�y�~�VMFVA-��5�xB"���C[0ׯk��2o��M�(a�Xq����z n�|�m��&N6��o[bdH�S�c���v�)�Nش�i�LqH�v��E�z �3��]�$|��)�AEm\�#�; @�?*6��)T]{K�&�+R����/��vz�e\��/A���+R����#-��B 2�J����tKV���pBL;c�1&���"& ��gz���1 6 ��!Ü�sN��e;#���V�gט�����HDT�@�h���K����܇' '�Qrۍ���]�_�� E.!_�^��=�s�LVi���%K�]��Η�ܝZ�QSҗ�SM�ƛ�O�t�8���E����EU�����J�q[�d�Y�L t1�ݑW~�>�'����b7��F�V2�UYz!���i�t��{6��7 �}q$��YND��TnP����"� �3KV�LT�<���zq����z��{��Dv�BT#ьz����rw$H��˺��M�_\O��K���{(�J�m��Ks���%�{�d\�n� �2ܱ���cgN>y%��G��,��s���x�49� �������~��2�p�K�e� H��h�1b�8� a>χ(l�e����l]�����^��jVb� A�Q�6(����@�>��P���Uoi��ɤ,�'Vu��Lݳ�L4�}�jk<_W����%��b�JR&x���v���p�������V�Ե��,=N�,s9H� Y��H���3o�Cb�:�j�b����^�g�5I0º#b�F,�7�E�N�`,z�b����z���p#&8�k�p�uݸz�C]�����ggx���!Ҳ�ŝ3�䡀�h����0o�"@L�(��D�{$$}.|�����!w���j�G�N�I� ��%d��{�<̡���rDS Dϑ5�����8<�Z=�����9�,S0{�� @�x���4�z�&+�荽y�)R?�*���/�W���+,[�7�G��
Behavioral task
behavioral1
Sample
f77a141e484602b9f28e7424b63acece3dfee8da864c899b430e9b3723b2643b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f77a141e484602b9f28e7424b63acece3dfee8da864c899b430e9b3723b2643b.exe
Resource
win10v2004-20220812-en
General
-
Target
f77a141e484602b9f28e7424b63acece3dfee8da864c899b430e9b3723b2643b
-
Size
144KB
-
MD5
2ef0e6198b9563e8153a1f518379062d
-
SHA1
32788a3c7b6588a7e4d0c4d5b9c3d1562ed235b6
-
SHA256
f77a141e484602b9f28e7424b63acece3dfee8da864c899b430e9b3723b2643b
-
SHA512
7b72243f0206350d08b4bf74d1a48502fcc78b3cafd0fb6c32a2ceee698f3718c2c81003c0db086ba204ba053bdc1d9651f7a3b33b37d4f456d51ec974b822fb
-
SSDEEP
3072:ZH+a50Px02TYUKaTZ4ATdzviF+v5YUFdiDZs:ZHLyjKSTVQggN
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
f77a141e484602b9f28e7424b63acece3dfee8da864c899b430e9b3723b2643b.exe windows x86
2ce5f3a955301ce76bd028c89db1756a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
comdlg32
GetFileTitleA
advapi32
StartServiceA
mfc42
ord815
msvcrt
strchr
urlmon
URLDownloadToFileA
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
ws2_32
closesocket
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ