���8��k_��"ɻ����}/�h������Os�|b�h�^���"6�rP��ՒXfU�˿��+�y?��n�̡&��.�x(/M�$7%tE��IG�o��E3�� ��������Q���C)=0}3#$����QK��p|^�"�qDd(�2�$43|>��bAG����Ü��v����� ���O��I�7ը"�6���i�5}=�X�ӓ��⠄�����E�����࣡��$�9�4�L����bΣ��2w0I���8ej���pP�3`3���,U ��Sް~?X��Rf�F+��| ���]zEͺ���V5J�pH�@lf樊*8��$�� �����72�g�]�2 ��(�"�hh{�a �����-�ο�ib%z>T����B���t��)X���J�]��c{7�U� ��%(VB�%����"�1�I=�~KT��O�&CщYD���H(��n�+O5��-^G����9� �ʸ5�s�:,�{��������H�iB鴜B�9��U�*N�rsdz��0œ�RDmU�i�#`�g��w��m� ����ٶ��Q�kXQ�Q]_�P�-�'~}i舘|8��������ֺ���<+'�c|�7ˇ�e�z�(�Qn?cΑy�h".E�V��w�����F���s��=�\����L\j��|3y�M�X��(Iɓx�}'O�u�'l�[�$���r��M �4�� ���>�"�4�b�qgԮ�Hy/��#Z9J� �&JP��~�v_NA��~�z\P��(� ����euy��^��K|x.Y���-�4r�c���Cy*}����/'�H.v�����/OS�y��I��`E����9��e��}� @!��FA�c�0�Ϥ9q[K�,SS!�C�jH,B),��4�0nPl���:%[t�1�������SI�&���!��"b����g�*�C̊�`wNF7��Ía�th ]���G%��ڎ�!eT�r�r��G^Æ�dk�~�����Ty��@Q���ޅ��T6�q��7�X�&���5��$�B������� Y Ϻ�^�y���}�y�Bs����ޛ7l��[�4N�� fo,�?M�E��g������.-lI�A^4.>uq�4R�c�q���1�c����t���3�d�ܾ���Ӟ��x"������h!n����*2�z`������zb����C��g��!�5kN�|���0�d��}�x�Lj��.Q��R�3! ���'�cs)t�?dB�1!l�@m1�w\�~��ep��)"���!Dڈ]q����S8��ĕ:�Da��3�����%H#u�/�V�V�����ׯW�A��+^����j����c]�Ƃh���ﳹ�ۢ.�`)��i�Ԫ��~Q���3�}��ax����w����&\%��(��H~m>a���'�MV���B����؏�}>����X��)�ʳ.a��ǾG�4}V��K&���"�M��7E�$�{�@i\���+պD$�b� ���}��)\�[J��,D��,J����5�r� �J��;D��q$��l���:n��^1��X�l�( Zo_��G���Y��yޟ�.�.�Ǯs���:�x 5\�qC�]+�=ّ�I������P��6��l$7rg�(ȕ)���y�V�ӬؒW(̓&V#b�v'��-5�`����j�׃z�G�Ad핪RzQE.�ӤO�������yT1��Pw����g�R� /�����1��ϯS�s|��~�I'���L;��X �rM���t���#G#�CD.����p�h �7`+̓Ga�p�)�Գ��]r����8c�J[��G k�"\�|^<)�p,���b���5��Q� ��;3�Ȩݮ$��w�eB���̝�����Ҙ�m{g��MS4��/�� :��j��猨�e�LCr�[�M�4}n�1�A�r�Bk����{`���y�nUvA�O�|�O%����.�8d LW۩��O+�^�w�A����6+K��Z��b�C���X<�0Ks��,��� .o�����OT�ૹ����}r�p�}� .�P2��<�W�ϴ/u�!V�c��d������ѾQ /�̆����3�i��������������l+G֒�Wvƥv��e^�q������� �(G�m�P2�$�(-]��R<A��/�+�!���)��� �/�s���wPw��Ջ�F)�YD���mR���)�8������o�\��O[����~�G���ɥ ;�nM����D`j{ �m���K0��ډ��:Kǯ(U#�(_��G�����Ye��s)q����52�2��.TdSX�j�IR���yR��?�[|������˯����nYi��`奶u�&<?��}CSO���[�!�@���h AiN�0I1�Ĭ⾵��`����%�1$��|���F@�����Co��#��Ip�_(!�\���\�!��|*���f��]���ư>���e����j�Q4�Xu}�X%Ȃz��ta�P@=r����[k���Ձ�ȹ�ZZ�v�:�9�<v:�|2�ء����+��a��W�1#&���!{b.7��,!#g�d�����Xf� �[��E2���T)���w' (����Jz\��쇠�w�����;��qA,(�]{ ;j<��K5���)(8���P=.2�A�t0):��n�*eՀކ=a���m�x4�L�8F�j�}YI�!o8���+�zD�ǫ����Z�ַ��.�~SBuR� ���=��!bUP.k�T��CN����L����{H�i|[�h���F��'\�J�@;(��x�Ƿ��C~��F����8��]���\�.�Z��:�Ώ��.b�3�sw^�� ��\����#;a�JTL(��8�����/����Һ�7�nˁ�ޙ����E�e�kO�]1���Ȯ+�op7����$i�lss�J�MO�m�W��9&�}jD����)D�{��7��W,��u��^f�ìyI��!.x!�j��mDkFI���*���3qrݡ{Fj�$\:������P�a8D)�� ^_��=���$
Behavioral task
behavioral1
Sample
ab9ab04aaa339bd94d2b26a91a755acb4cbc0e8cdc000d90ec7fecc3c9c9400d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ab9ab04aaa339bd94d2b26a91a755acb4cbc0e8cdc000d90ec7fecc3c9c9400d.exe
Resource
win10v2004-20220812-en
General
-
Target
ab9ab04aaa339bd94d2b26a91a755acb4cbc0e8cdc000d90ec7fecc3c9c9400d
-
Size
140KB
-
MD5
b031147cee48089c71a7288a7b3b9a2c
-
SHA1
000c3d3e756b9aa5147200b62c9916569f054f47
-
SHA256
ab9ab04aaa339bd94d2b26a91a755acb4cbc0e8cdc000d90ec7fecc3c9c9400d
-
SHA512
0cabaa5a4e8d4201d708483fb2d354cb32cdc337da092fbc4598c221e186189119c29e3c200e1cee22c443c077abf7f03df99ee783dab450bfc9bee604d203c8
-
SSDEEP
3072:kwxP4jdoCRRbzVbW9osw9ZaEcdCmWAaGl1FkhK7Hc9V:9P4xoCXpWmswZPcOAaWFWK7Hy
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ab9ab04aaa339bd94d2b26a91a755acb4cbc0e8cdc000d90ec7fecc3c9c9400d.exe windows x86
2ce5f3a955301ce76bd028c89db1756a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
comdlg32
GetFileTitleA
advapi32
StartServiceA
mfc42
ord815
msvcrt
strchr
urlmon
URLDownloadToFileA
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
ws2_32
closesocket
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 124KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ