}D&�%����_˛W�A-������m�Z�ї9 i(��K��w�EDte�����N�,p��G5��y�ts��Q�CB��F2��P��f1@�w�7�{��3���ϭ�������\�*Œz~���|T[��(i�0�K�ET�^��'�q��Mp.ʙ��7���N�����)O>�z���P]͒�~Z���XO�����G28��̊XF��Com� p�\�Ȱ"����]w@��t�K��|Pm��ڷ�݁7��#o��S; %.3����Xn'=%M�� /��X�h{dL���y�s��C�lu�� {��3�����V�w��~4t�ɝ�V ��p��4���҉�%Y��$(�W��N�o쇴��K[���ldv���)ç��#*�S�w�4:�u�1����s>��a��r���ފ Hϣj�ƃ�괙.�?p���#�Fw�Z�z�|!��wj"𢺂I+�&|l�u~�`㊏��O!�g������^�Q���|��%;l?��n�g&�pbwg1F%�C ��?V�(�G'��x��Qqm�]C��:�� ر�(9���Q���|�W��j���PU8bF��GЎ�J��U�,B�����:k�EB�r �h0�3\��OM���0Ա���-���z�T�~([��"�z��㩍>r�Ɛ�/�è�K�0e��tʲ���?�� ���!��p'������ ���8�KŴύ���}�e���1�a����\'~�<�f���$8���lkA�I5��+���LU�j��*dp&?�Њ���ի���!�U� ��'j~��-�Gą�DRO>U!��h�qC��Ti��a�MDSTd�@�'�o\�����mi���uC�@W�s60���|̏� Q�(�4��! ���]>�O�Tx��~�N�2���j����H���7����K��=n�I�]��.����Z�Mg���X۬�N��ָ�d�_�~���庘�d���=�w^�=��� 1P-�\6���1�q�1G��@�r����4��Y�su���$��y4����`�iX�$�~\K�9_��U��h�,�bi�!`�W�����1� Z�[���>�� \�1��<-H������"#��Uu`ė��%���F�&C����_�U�;�e� ��s�^aV�%lOǯ��Xϸ��l�*����2H�6Y�9uu���)�g@}_յ�@p���BI7 4�o�Yэ_�4�|#�Y�v��U���sz�2X�!����I��p��h����܆�g�d�������h���W6�f&;����f��H)B�F�?�>��e����/����V����z����>O@�2�u��r��������qȄ��r��c�/�*��`��(v�*�z��ۯ�_��p�5_�X���������Qu��tЀ@s BN;���a�Zcԣ�v77DW� =���~jFDRL\)�1�:1f̸���R|����j�T��m*�p{;��A�]!����ی������|ĸ�l7x�����,:<2�u\H�J���m{�B�o N+�Q���|��HئJq=O����ljLV�� JB�B��h�Gۑ���5@Q/�L�!���t�����qf\�ld��J�d&�c�A�U���������1��C�)g�S.��M�E =��VNܜ��'�U�MƯ3ܠղ�R��d�'����pE�����c��7PIQNVa�?����s�E���fB�h}�������wl�͒��ct�"�&���^����xT�Y�|��r�я��CdrIս���м����#��NW">��QO��~��}���R(����#fQ�9D��oE�Z�^R>"Sz�6)]|]Cy1�����E�?�"�B�&NM��ѕP�v$A��L��h�KUU�*c�V���0�ձt�x����0l��q�Y]�{�i�1<���P����f;Ԍ9�p�{Ƨ/�:�ܕ��a_i���1f�mƛgq~'���Ž���������s+�T����� xr`U(B�.��C+��{;WF�o����c<Rq�8� I���茺��%Jb� ��d%t7S�˵�oD���HW� �]�����>����B�_�_���﷽rҺ�x�_�'����Nr�T��f[-��KַK窟�X�O�N�:���m��4�I��y���-I��Ԗ��3�{"��J��لE�Y�t��&���< �ӓ�$Ai����Tb:����ޭ4Ҍn�UGOނ5��,�B�(D���3��g3�� �K_�eL�H`�&�ſ�9�8d��B��{{d���=���{0��?ɛ�H�����K2n��d��` P}��qik\ 6��ioB��k1\�X�rzغ&� ��ṁT�z0�kG��4��:勱N�v�X7VP���qIt�ؿT�r���/�%44����cEpe�**Q �l�a�x ��r� ;sm|���p���/�!�#�@��� m�^���UY��s)��F��G/>���⨛k71�*Ό�N�Mo_!� �5��tTa4Ռ������V'Ķz�r�xe��H����d*qc����������]ׄ\(`�R�le�q�wG����9kb����F�<���XU�Y�J�����T�=�xl�������"육D�RSG�Uut��d�8� 2�T`��Wǁd:ub-���'8~��-����� � ��w�RE�bP�5QA��C-�ֶ���"�{�1���qe]sU�p4N��Ⱦ���8�y�!��3�Z�R�!h��� [늓�hG�W��O��b�c����������Ž�������0~�0����`��,ø�l���s�HNv'*�!=�� !X����[�h��]`�q���1���ɶ�%�U����L9����f`�c�_%���i@���5�O �ٌ>��|%B:�Np^?zh��P����0]U�/||�M|�ҫ�<���*�(*�k�/�y�e.0��I8�P�f��9��qO�sg��h_3y7��G��#��8`�j!�������|�����ŷK!�%A-4-��G$��8De�Sc���!�l`�7lw"D��~�?[l����)��VO���&�����A�
Behavioral task
behavioral1
Sample
fbe01c4665aa89a9b33f16c679fbc3a327c801d58c999c3f05c3c928afbadaf8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fbe01c4665aa89a9b33f16c679fbc3a327c801d58c999c3f05c3c928afbadaf8.exe
Resource
win10v2004-20220901-en
General
-
Target
fbe01c4665aa89a9b33f16c679fbc3a327c801d58c999c3f05c3c928afbadaf8
-
Size
99KB
-
MD5
e78774a8ff61937527889b149b628484
-
SHA1
58ba927411c379bf42a9503048512bc98e3e67ce
-
SHA256
fbe01c4665aa89a9b33f16c679fbc3a327c801d58c999c3f05c3c928afbadaf8
-
SHA512
98b3ce71ba6287302c078512576974745bfb8683f8c6b874de15e4648823f0b1c9e4c20ff923917d9c962db57287be5caf52813fe197260e80dc2db76a3f00ca
-
SSDEEP
1536:rVsRZI/+AjeW1gSs6wyUKIpBXuxGqL7WFeEjbJPNmfzRgKNuRnLyFs9jzGMui8V3:rVsE/+An7wyUKMBsR4PmzRswgjOi8
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
fbe01c4665aa89a9b33f16c679fbc3a327c801d58c999c3f05c3c928afbadaf8.exe windows x86
6b4cd14ea9819564eb65b6e560a259da
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord823
msvcrt
__CxxFrameHandler
kernel32
GetEnvironmentVariableA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
comdlg32
GetFileTitleA
advapi32
RegCloseKey
ws2_32
WSAGetLastError
urlmon
URLDownloadToFileA
wininet
FindFirstUrlCacheEntryA
Exports
Exports
Sections
.text Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ