�ӼRh�Ś�4�@���i�E;?~���}�Z9�\�nm��d6p��Ÿ=b��ɬ��1�#�y#O�U)n�@�n(e��7��&iٱ}:zq��e3�$-�����7/K��B��P�����H��亮v�"2VPW4F���s,��y���*&�NqE���?�EE^Q;�#}t�m?��IC���S<����d�Y�����>�( C����3t�o�ۂ�ld�<�|�.E�c������ܒ�ɶ �����c�6��u����x�<É�Fx��`Vp�+QjJ��[���"��Q�_s���g���wn�s�N�PS��k��x�t� ��xL�io�K�c3p���D�]�C[����|.�41�Kv\�t�|uʔ�1�j���{$wť�0��@OUH;��%G�ڣ^ڻ���L�@�В��9#鳦�fA�j`o�� Y����"��������s�虢�؏����IJÜ�a�ρ`w١dm�*��u- ����F_��D�&gr�<��=Y�v�5&�����g���IVM~(�������Μ��^f�ODd��&tw��J�<<�i�R�1z��O��-�k�0É�WF� ��{���gް|l���'�������=w� �Ղ����K��ʶh��[^�M^U���/>XY�a�; qҠ�B���k��T]vᳺ� T�,~~��a�?����%~�v�����P���3=v�9�����C`��F;5�P�0���ވ���74�q��Z�-}ܤ�/%&HQT�B��P�:��r?C���tR��F�8Χ���4b������ ��I���k���Xы��?4G�1 �2vM��G���� �ʲ��ȴo���%��c*IF�wU��[�I��&���"_�O�$���pQ�s�Z����&����k��=L��w>���6i`C"��� }�2�N> �� ��\��^h �tK|��e^�y���7�w=ZN�7�I0�� ζ�+��� "y��q.s�EmTO�R��^V8as�X6v�qi�ٲ� �Kt�6qk���>��r45x�!���K���@�hT�V2R9@�����Y�@�j�0Q�9��7�: ʹTAW�6�Q���x�e~z��ڽn�ے��Q ��O\���)�>���������-�\1.i�4���X��W@:���j���t��5㚁LzDm���Z�� `��!/VE�x��%=����C+��%��#C%��*�� >��1I�hQ*�u��s>�z.sz{�R�&rm4����������M����-�>�ϋ(Ѭuj`V��X����D�����K�)�3�ϚV��ψ~���u�N\�:��3��e%��j�]i�0��Dj[|���Ç��иkT����>0BȘv��2�Y�,Y�+�M�c8��3� �����q˞C�*ށ��� �t/��r�WYD�[�y�H �dӳ�����@��&b o���!v�,���:����P�q�M�����[�q������S��ޡ��4d�'_�G5S�5@��샜@�����Wg�4��VJ����1��%��Q6�=���t}�'�mO�=.�.x$͘�E5��)%�P�����PߌAs�����)��G�w���`�F���}��D�"#p�T ��)��Q�zaS������p�X`̊�Qά�' ��r o[� �݊I�:ώ�օ)��J�N�b�俿�ʴ���7�n���M:"�3Ø������j�Տ#|�`�<��7G㼢5��k n-m���:;0)�+������' �)t��`�0��������wJR�3��/�G�DBX�k�{�d� ">�e�Q�6��#]���=�h���ϴ����ܼ����a'^�;P g"Az6&*�bS���+jP+�9�h�}vL���4�i�c5�?;��<6��ut��|=�mje�(�qOJ������$�T���α���7�`�[�5�h����Q���xֿ^S� �<5�9�Y�CsE�g$���ܑ�pk��=Dž*�BPK���������Z�$�4�Q`��]w���#�T�ʽ���+";:�/���m|�~MO��z�!�����o.��&�[����ϱD��Oel>j��/3F�:k���O��z� J1�W�ߡBuI��X�$"5x�=�7��X)r���^�XJ�c:�����Κ�D��%��R�7{�oY�r/�M�0�^���ێ/�́��t}"d���U�gK6��#X���a�����Kh���I�L|[3�g0������J�C�Ь�u�7����.�J�_d��3#��<b������9'u.���/U�!-(���e!��w�4sy{�o7"8<j�gm�x�#ͩ�������ܿ���=�0�1zU�Md:2�l�o~��ʨb��@�e����e���^�m����O N�xA�u��b.�������|A�f!z���to�����kR�ݾ��/1����a�5d�̜\6-z��X�\���t{�N�mS� ���2cyV^lO� L��U&#��-�c�_*����١�0� U#���w`X�<���h]r �|��qv� ��9��P��%��WF��#όӖ_�X?�#^YRӜ�3gKp���s��-듳�����2��ZK�^U�J��0��N=�n�z1�Fu�KϜ���NY����1��� /�u(͎ų�]4;����i;^�rBt�����y'N��*5����)v�Ih��KK�� ���f�fRl4�+)�Xa�!��X-��;��k��4$wh�����q�?H.�� gK���@T�x��=a6�ߩ����'�$k�R����`N����!�����à ��p"�|Qk%��,��5�k�Zt��`��Y�b(tf����r��q���tT��%\�@��":;eI�+���@�M�t=1 ���;6 �A*!�Ć�uY��o�����Sd�Qf&�������q����#E E�!*L����|��D�.��7���TB�>�����{F ��n��/��������� 2�k5[��1�s�|��3[�T)4+� C$�5�zi-z(E�x-8�C9�= ���':��@3
Behavioral task
behavioral1
Sample
a3df05d7c498dcf7af9519f4675ea2bc4545f82c8931e3140643d78ffb49290c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a3df05d7c498dcf7af9519f4675ea2bc4545f82c8931e3140643d78ffb49290c.exe
Resource
win10v2004-20220901-en
General
-
Target
a3df05d7c498dcf7af9519f4675ea2bc4545f82c8931e3140643d78ffb49290c
-
Size
896KB
-
MD5
bdf2562c19a3f45abdd1f93ba1dc79a6
-
SHA1
a18381a4db62360cf956d455a8c7a61beccd367e
-
SHA256
a3df05d7c498dcf7af9519f4675ea2bc4545f82c8931e3140643d78ffb49290c
-
SHA512
7c081da0e4d17e2ec18bf8095627868093ce01f8bbc322530581a342ef47b41849f6d8ad983d1600129aba95cd513ec879f3d3bc2151907e250d7fc6db898b7e
-
SSDEEP
24576:b7W6R3PaTxx7DZedgpZM9o8Wn/5rbQBCl9qeh:b7bM7e8MG8e5gBCZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
a3df05d7c498dcf7af9519f4675ea2bc4545f82c8931e3140643d78ffb49290c.exe windows x86
4a51f952caab07fab86896204fb0e643
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
msvbvm60
__vbaVarSub
Exports
Exports
Sections
.textbss Size: - Virtual size: 953KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 792KB - Virtual size: 796KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 140B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE