�LkQ��qj�g�f��O�������l����FfAR����T�&@ `a�ڊ���˞�����#�Hrz��� _�jxg а���`7�/�,϶�����0���=b�u@��e�5d�v"��[ ����se� Lf�c/DPI�o��M��K|+�n�-�&�56����pQ�h��Oe����M$R���g�<�CE`����3.�`�v��G#�zr. �0����pϒ�k�H�F����Au�"[{tcP<��6^�Kw�����=��"��������M� �5ǞQ&�Qgg:�l]��"owG�����ǭ�@oRڷe���VU���`M�^�p������h��JRހ>����];ЊOwH\�8�D�4���ڼe�ȹzߨ�Ȩ�L�_��D{U��`"h*��ʌB$��0�u�o���N�Eꪰ�#�dea�W��e�����(�M�[�����];w�%��g���HC��Cj����cz��r���{�Mz�O�����7��SM���7d\<���jU���G�P0ۑZ�|c�l������H_f= ?�<���x��BZ!�><�Z�r�L��# ����W*�QR ԭ ��R���V�ݒd�ް����(��n�WlD�~���9Y����8���7oo�e�����_�rV�0��� �����:��j�J�+���k� :S�3 ܜY�Sb�O;���7�mp��&d̸�������@ʖ�ʟT�*��&�T�C5)6d�ʵU^+��Џ��6�G6ͻ�ڃD��S�F?���Z')Eҵ�|��=�~`R��3V\U�%F|��veŜ�Jc�����z;E�� U�rҕ�9)�,~�[�^���H7��?5��%��L�}�c� ����R�_t�!�P�6���e?�����ԉˡ��� ;��� ��x� ��_�9���AiP��x|IΓaQ=e4#\�^fY�@UWy�r�3!9 `oQ���6M�\kN#L�����ݯ��Ӡ��*"�S�^���n����L�eTga�`@a�/ ��*�|rW�Q�4�������me����#&�����f������7Rrkl<53q�6C���49��kh��������|Rl��"�S��f��e'Y3t���b�β����l���"["?e����`#J�q�dm?`�]�BK�iŜ��3��A���ꭩ��ՠ����a�/���6�LѤ*]T��-Ղ{-yD<s�GLw)��4�G�b�r�[ E8����K"j�w?�R`}��U�����$���~��c�Z�G�`b,Q]�*��@o*���5d��z*�k��mJ� =����)��X��b8�����_uLB�h���GO�_u�9&�&���'�%o�|1#�0z6����/n�^XW2���l�xx�q����a7�����W�8NY~ʹ�737|k��!A>�=�_7LM�r�ޕ���*\�p"�r�E�=7ܖ���N�ad���~�NƶE���sX�gz�C� o'����{2䏯�s��,[��!��!�.1@���`���I��3���l`x��l)ݬ'K�w0>_�pZ{�?n�;]:���y����k�t�cG�����ᄤ���l;V�dɖ�%��p��+�x� ��i �2v4�X�Ӝߊe)���M�w��^�@���4��.c P�R K����]��(0�aB�2���vгvs����˅����\��E�4O r$]��4�G�d�@]@CY�l�糺�u&�{O��I�9+� )�6]�RW�i���N���Hg���N)6"�")����U֟_1��nw�+��h�+�Ʋ��=Q%���GW�&�O�Yp�����/W�G�oYK�%�v3KI�_�6m��9",Џ�(d�v�N�.4����'��<�?onnOn��%y{H�m����腔g���@���숼�T ��&47���u���������2��t\�d��9�V�X�x�Lp� uc �H��e�T��I�X�KvmpV�rh}�j�s���dF���e�V���ߎd�Q/d��3E�ۯ2�������� ��k�j^>�Xj�� Q=μmy��9S:,F5�H��k3��;��y* {�S�䳌��u���a��N�VJ�}%�W=u����L<�z.�c����vS�t:�(O�����9��F�������Z�z����'����}�Q�o�h�C�>��κO�t�܉M�O���3#�D'�M��O�PG(2� ���W�� ON�մ����&�9��z۽N I�1m8h�rޝ:� 6��X��U�C`��|�Z#*��t�#�mSw�4z ��V���Kw���.d�PN��f�@u����p��M� ���A�OD�������L��[xf��VBm�i�y����R������T���� ȡ}R�~�=�X�oTDU/0P[G��q��K�8~�j��[�0e#o[�� �(���Ӊ���{�tp(ͭ'�b������´.���©��p�#�2W���ߺb���d��ni��_�Ax_������a��_�hn�'�q���,�oO]�+viSu�m:I��m�\�G�wS�x�ݦ���+��l%Ck����&��j��*�츰�*��q,9�̹gg�nN��Æ��,w�h#-�ύ�^~h���3s�z��r�����,[�x0o���į��eq,��h�_����v�����6�% o�C�S��U�&,W��M^M���q{���ۜ5�d�ڃw˯^(�u%ދD}���y8����b.��y�m.� F�<�4�����;����I �F�DWR�ٳ�3� ��Z���S�|��|�4��+�X����~�$P��X�o����1�6�U3���!A��o���E�{��h�^�!j�+��ԋ���M�`62�Y)9��f�m}9�l���]-�� ������Yu�ًm��zտ��(f�꠰�#f$ �6���{C�Q�8��d���+�qo>�j&�*�%08��0���G�f���N��q�h���C�*%�]%H�"WTF��0�3�V^ɢ4��o��<?�� �c���i����Z�s Y?��}C��vj�ܸR=W-f1��,�-
Behavioral task
behavioral1
Sample
22823d35a75c30b1add07418f38faf3b506216434c0646269c96652b5c343c51.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
22823d35a75c30b1add07418f38faf3b506216434c0646269c96652b5c343c51.exe
Resource
win10v2004-20220812-en
General
-
Target
22823d35a75c30b1add07418f38faf3b506216434c0646269c96652b5c343c51
-
Size
114KB
-
MD5
a9cde4f2882ccf2a0522faaec8cb4ccf
-
SHA1
24110f87849366b50c56e230f78f11bb75cbf69e
-
SHA256
22823d35a75c30b1add07418f38faf3b506216434c0646269c96652b5c343c51
-
SHA512
9c376e01bbea1da77bdc7969947d25752a049cb2cd9aea5104c50d46a3d2ecd15625743bc6d5c96648a6d35d61b945195a946935a619c676c9bcfcce3c86ce83
-
SSDEEP
3072:jiMD5SEoeTdILFTFQjAgj4qcko7kp5B0:jiqSEwFTFQjAgJC7af0
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
22823d35a75c30b1add07418f38faf3b506216434c0646269c96652b5c343c51.exe windows x86
baa1d8709095792213640505e2d0e8f9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
kernel32
CreateProcessA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
RegQueryValueExA
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ