bt���eEN�8h��d��Ί@���tEn������)�J��M��m7���'��+D����@�������I��N����U�I�(�� ������|=�����L��d�o���5�˪��H0��`iO��l��o_C�?�J�zU�~m�ڌ��^����G�]�����Bg clC{#�9�]�!�`yyR�;�� �8Bi����8;ҋ.�,~�#BX��K�y~�%1���Czɝ��7^�FbRq���ᓝ[�6f����x��w9�a��^y3�ˆ��*�^�6e�l�O$�Ey�@5pg�@�)��9� �W �hΊ�E�âJ6y��5Ȏ��$����ym�LJ��vE�6s�����ELxΚQe��)���rK����t4���y<�*�i9�����k������+T�< ���������7��< ����@�:.�ىĮ�z�M�A�k5%�\M#���"�w�t����+�����r6�}��F�1�a��)���\=Ny/��oHk���n8���q���p��Z&+�^���U �CM�x����_�,��X��A�h�A�O�]Q1�^��:x=�n����v1z���#n )�8�>�}�9%=�ɇ�D�� �U����0�xB�Y�c��U�:\C%�,o�>���;Ͳ��A�>�5mP���|��JP=��49�Q���Jt���b[/p���wUVE��[q�f{*��0�l��X�x�ٖd��w�mS���r� ⿑c�p�3�/8�d�;��~��R��d�%2vF�1��'�)�k�QGO��>SR�35�:F�G�0z�(;�U����3���ْ�c`q*E{Pӭ;�!�/y�1�c[6��]�56�Y`:���P�ݜ��کK����0[z`��;j��s9�-9���Nj�fB>�Ư��1l>�@����{�O��?�o��X_�������cc*c�Ů�:��+��/�I���P~�$+��v�=cС���hk�hU�3��1�z�ި�Ȗn��f��*]|���\%��Z� xI�0#� Hu:�G�W[kV�*eI �{z�?�i����<M���>o���]�L*K: Wj�Z��Hx\�Z8ۏQ��l�ڒ䆵��A;��Y�,�&�{j�c��g�xY��T*��5�����3�S0+j�֏�b咓��!�N>a�^qg&mq�~;}<���N�ߕ>�S��.BBlϢ~� /���x��~.�M�w��0DO��q���mQ�������7<?UZ4��"B��Z���↔�<#���}� G}�3���.���xcm=�)�߲������$.08����pJ�����w��@���~�O���S��Ԫ��Բ�'[x����Z*e#p��Gx��Bŝp�ͰWaWo�lŘ�A��"'\��Α�G4��~K����̵Lbr}ĭ�=��P*����ʋ���a�~�2�+I283@���m�+ e������aڰh`��$Y��<1�h���Jn�=ؼ����d�B�n�;�b�綴<�3����c6����}0�2�����z^�Q����yH����u)~��`�0��.��{5 B/����v@�C�\t}Y3U�h��nz�6.�8fXӇ�[�ҔX���<E�$O�����4ŋ�GI� �З�Dt��ì>�TC]b!�>Q�勭W������=��h9�:��4�0r��踖;x`��#p�t*����$���A����HF�Z���#������EwF�$�Ouy�g�1��0�c�:zp��ۄHBn��a��"�!n��V�T��Y����KP�P�G���k�^B�u�ܩ��a�}wI,`�ҖA�Hs=>���*x���C���G�����?-(5��?=�{�K?�̞J���g�饐����A�o��T�|K9��`����<������6��Yޜ�0dS�x}��������%�נW������<s� ��'�66�+ڪ���oö���o=�}P�k�O�~|�C�6������=c�/L`'���o����!t���-{I[�X+��m�&������ ����)4�.�����.3�,�Z�� Y�62�@jB��nO��C�:�^������^Q�.%���F�X��ʨ �+sb� �;e�V����b�~L���ﺕP�o)�Dn�J��9zv������bi��n�+�@-�=̃Ue���>�8��s2��Y�6zz�TMZ�-ڻ�����c�/���Á���|h�Y�qM��I�MC�p�@��MX��MK��UQ�js����9}��v'�[�pS=i�:1�Wm���d*��Y1�p��{����`Ó�}��F��}Ky�2I���<>>0���������'��IۿO2F�;'RXL7��Hv�](�Pf�6�e�5��I�%��o����Rk���K�sQL�L��s��L$��E@���X��OoO>�1}s ��߲ܗ!c���u+-��o�����X1[%} `�&���|���54��gP�,jl.t;�v���@�a�6���騫LCu�np�L��ӹs���+�"�����_�:�"��D�C���I̐�&g[�Ⱥ�G�I!˝����d1�d�������'ev�5I���,�Fʂk��/�G�O�e<ؕsq�@%�{��ͭ� ��eF�;'��2��z������D ʭK%�i5�X|�~��%�/�"�7����:$��������w�-Q��%л����a!B�bŹ��Z᳑�F�g�wU$�S���0��wR�� SXLٹ�X���y���`�Ъ!���(/b�PS�g��N��I\�~K���۠����ć�q���5K�=�S:�^�����Q I�d���}����WE��M�~��lp�D�� �?�]���ɷ�0VK���Y����`��Z���ޒ}�:X�����Y��+�S�j����)��z0E���:�����Bt8�������UDYI��մA�n���\�心�%l��6�ǚ�{�������0L;^�u�~�vU2S� �Af��f`��I�q����:ܵ� [XH;����9��\h�o�U?Y��_v�;9
Behavioral task
behavioral1
Sample
a5a8377ca7d5996323cbb08072e8ad5803fbf65dad5c5298284b73e09b52f91c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a5a8377ca7d5996323cbb08072e8ad5803fbf65dad5c5298284b73e09b52f91c.exe
Resource
win10v2004-20221111-en
General
-
Target
a5a8377ca7d5996323cbb08072e8ad5803fbf65dad5c5298284b73e09b52f91c
-
Size
116KB
-
MD5
2dd5566a545c687b3b770f24d9a4fa4f
-
SHA1
8ca957d133a82ba2344401f05a9a320ee37c1c09
-
SHA256
a5a8377ca7d5996323cbb08072e8ad5803fbf65dad5c5298284b73e09b52f91c
-
SHA512
a2fe42aa3b4081feee4924b79ccf49390394af7d5a8ed3f73addc437d9a3acd3eb272da945cb14b2eeaf29f516cc6bc106ba6e843327990a39ccf1057f103d1c
-
SSDEEP
1536:oJwB93uVGLnuTaLupX7RFJGE+RsPaaxSVKR0mI53pAs34vc7OtK0iDg+SI37:LB93bbuTaqIESsCaxfRHOAsogOteDJj
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
a5a8377ca7d5996323cbb08072e8ad5803fbf65dad5c5298284b73e09b52f91c.exe windows x86
67ac417eb2c7047f85b8f6f2696e1dfa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
MessageBoxA
comdlg32
GetFileTitleA
advapi32
OpenSCManagerA
shell32
ShellExecuteExA
mfc42
ord561
msvcrt
_except_handler3
urlmon
URLDownloadToFileA
msvcp60
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
ws2_32
closesocket
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ