{z��I���������RV�n���攼�l����M NN_���+Xyk���>ͻ��B�ְɼ�Sf��@p�,1"��{ �.`���b�J����P+I�lDs]�����Wj�~�������d������4�����*2���� .H�<�Z�e3��s�tR�$��:d͕��#h�����7�pv5F��1ʍ]�'O������#���(�'�cE�=D��e�`�f��$��ΰzB벂R������="������R�ZL�.EG��v��Ηa*#�$1C�e�a9��Ct����j�I�/K�L{��`T�6 ����p4��}W�c���� 3*�B�~�����Q����)4�nR�� �-ބȠ#qZ3W`� �W�9=�W��ӥ�٣�˗6�6�O"�ra�u`�ŐŮ(�Wb�z6GQl��#��c����lb�H#�wn�}�3,�Y�Cp��A۶ƀc�L`%5|��3r������wf�i*�٢*�2�w3(���!J�q)w*� �������ÿGR��π����x�z}q����9� ���(�ee�� ���.��W��X�Z���Vr��ى'7A4�n&�,A_���t��ei� ��� (F&oaL�i��P�[ez�L���/�ֶ�5��sy��-r�ʵb�'�Tڍö�rFʹ�I�LҸ�b��RX����Wc��k�2��2��k�t��� ||�N>`o��1�'� j��0C���u��z�+}�ɱ4� �(u�p�߃.�M[�`���~RQ/��(�Mz|^D�&� ,DNox�dfI1C�g W���P��Ȑs�yt<�k��<�v� ����&��y�x��܇~#<��IH�$]�ϓ��{%o���5�R1���o���V&�) h&Ԫ�I���R�LJhȨ���rQ]G�Q��<t�D�q��.^���m���m��2�A�)T�&���+���n��4�w�<L���pr��6�s�'� to H���c�������x�ytv�\v����f�^��>�C]LZ�V�G�Ԝ���!�< �8#]´K�j�i���rp��K �<�XA���6���C!(T�d�O�|� �!G����+���kyA^a�3���lǕ"n%��u��L�%-�va��p&<�N(t��'�#`�q8GG(7W�����LG`��߅�d�Pmdo�0q�t�G�\�F�b�q����b����!���?�q8�������}����(�*ZC��8�2{J6������Vm�V���\=�{��������¶��m�/�B���T��%��9���0N���N{�c2�W�*��}���;t��O�ļ�ֲ��a��QIڜu�(c*��d�=`��9�~� @�/B�{31u��r4�rk���m"Os�X�Ͻ�C����j�g�Oى�jj�a�W���Ziv��Jx��X��@ac "��E���1�-�e� ݈�zIt.���_��)��\�bcR�%�� �x�����@k>��Y����G�E<_*0������vBݫŎ> v-{����|4/Ni� �F�%��ܓ4Uz�@��������{��B�м?���uo|��x��u��U�3� Ky����!!�����rC�w�i�e�O8[zb{��\�BɜX�e�W��ێ_��0Ʋ��a$��]�.�����P7ꠎs�=J{#M�����e�;��*<Ӏҫn �NUmY "\R��C��k�&��_�q(G��O��-WiSժ���� q4�H]�Gih�q+ �����]�$!��U���Ev����С�j[r��=������6M���'��,X�l?��J��*lU����hė.�03>]��#�H���TW5`��9�6:�����]V�澉���m�,����X�KR�h���V�Z�����a�����Fb+tl �V��D��e������xy瑬ߪ�.���MXŹ3�܆���SJ��Mc�wJ���.���!-89W}^,�z`_����cmT�'smS��dG��0�S��!��O>}{�X���l#Q"����0���hمD�� 3ى����� ��� m!���R���lN*-\4�N�x� .�rs ����PmA�hhʺ�K��U.�Y�E�m��ft����"�:x�ވ��Q9@!��-�=)\9��g ͊k}"QCຟ��6F�1����x�ȣ8.�� m��:���7�o��Z�/�^I��R,zVDSYsA��E�Bf)yp�S�.�!�]�y"̿C�G���d�x)�d�b&��Z���1��*ɖ��Λ��FJ��EI@����2.�]�r�Js���'�4� �.� �f/���zc�H�� T�N����`l�.(�#VF��2�jn�CS^X�DW��=?�xu�������,%��e�2�Yɠ�������0��Q�pB�<���;���}��g.���PbD�x��UϚ����;\��H�(#�j"��F�#B��\��̋�^'�(�v/Gޕl���l���rPE`���4������!<S�ۙ(fPz�� ��8��ߞ�����FE��Q�Ȕg�>�:|���T�RO�ɭN�����~ʑM}�,��1Ha?X#�va���?�\�.�5��s��ѥ<T>~����{ὦ;��b����N�_�D�u5�:��#R��6oN�i��x�:I��;��kh:���CS���0�X� h�w�˽�h�V�=��:@$v1���QR��Ւd���ݹ���v%N�.a�IKzk�F�ק\����5�N��o,<���u��OCܮ*$��E��2�y�ӗSP�詄��oV��H4p^�+�+�D��68�|Z\�0Z��m��2=���@�* �sT���S|�K�?d�]���M�H/ ��0���ҍ^p7¢�n�+�I%� q�Z�V�sM`'[vؙ�3�'�yۙcح�;� ZP�=�OII�QYT���`���!��Η��|��:�h�A���s�P] �6��L_��]��~v<7z�_�h���|��o�������v�VÑ�TU��n�^ �t�I[ɽU|#.D��
Behavioral task
behavioral1
Sample
ade485e880ab8ca24b3bd738da71e7c803847380fb1a66af9059f90dec0d6049.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ade485e880ab8ca24b3bd738da71e7c803847380fb1a66af9059f90dec0d6049.exe
Resource
win10v2004-20221111-en
General
-
Target
ade485e880ab8ca24b3bd738da71e7c803847380fb1a66af9059f90dec0d6049
-
Size
720KB
-
MD5
f9a194952020a25ca7e92a72afcbb6d4
-
SHA1
12d465dd3b82f494c1fde7b5e985ac0e6f8bb10d
-
SHA256
ade485e880ab8ca24b3bd738da71e7c803847380fb1a66af9059f90dec0d6049
-
SHA512
5584fa5d3ac7794eb4b83ea07b8a84171665a2d2087b7c44429e39fe4ca15c3368d7afac67fc3c5cd6b20ee80663bb0c0515236d69f946b44a0c5b901573fe43
-
SSDEEP
12288:2ZgfuWnG1RT1E+qHW5YGxsCOEa+MpeJwEDgRG8reNp+pCeXXz4BaucXx:2u7Gz1EFHW5NxsEnMKH8E8ren+pC2z4u
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ade485e880ab8ca24b3bd738da71e7c803847380fb1a66af9059f90dec0d6049.exe windows x86
e8c1d7c1459ecb5acea3327d6f94f6f0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord717
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 646KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 708KB - Virtual size: 706KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE