�x/�"f��R4����*�h�7��?{���iv�Q{�&:�������'a'���~�(M|;�0��n�ϼ�Y�Y xT±Cw-ΘGXc�6��xV�:�"%�U���\��֕Y���8��6kxo��|�!�g�ޡ� �*XVaaM%x��(���<���lm����T+�(ŖM�צ=�^K��(ɡ��a<��zX�>�(7��Y�R�m��Iui�ӈK{��kZ�u��K�p��VZ]�J���$�ѥ�����W�hmV���\�[s��S}�aR��'��W8�1� .S�1��Bn���-�N����v�o��8���''֗�r�Tm6�_ �p�m� �:x~�{��A� \��<H����4<�������`��,`��C�����A<{�H;!2�2P�����#�3E�����n��;Wxe%�yʣ��|�n��ٚ�I� e�b��.��+:zۚ��3p��'�� O&) ���ڂ_���������O�]�呌�D�����(�~C����?��yB@�?��u��~e�C��k�����(Su5����D��pM � �'�H�Ƹ�����*�^��t��u�ӕ�UC�Im�.� STTq? ��~7�a�l@nnڍO�PnL��d�����c���z���Lc8~9=����6ibM�E��y���mP��`�^����1d&����R`��@���1����d-�w6�� �d�UW/x �'MI/x(����;@�(�Sz�z%�,��Վ��k��Û�>�"ƍ��(i��?V�/�S�� ��� ܌�/�sח���\g�A������#揙��(�����H�BVd��D�Қ��A��N� ��ҝ��[����SJ����rE�\9��m�b��Y���T6���H�6��ݡ_�m�3&)<��F_F�5Z����oC�^g�7�0Լ�+��x?��%�n���!G|M�>2� ��P<b�~p�~� sn������#i�z�M���U$�x�7� U�!��Xs����N��t�°o������`�M p/�J�"z�+���ל�أ��<E��{�W����Mx����o���QjLx�v�h�TPn��M���C�]���EP�V��:�m��ύ�E�me5m��,�߈�����F�(�g�(��xv�J-��כM8�\���$���R����(tU,�h�Q��a�J��B)M�vl��� �ȭ�EuG����Z�D�y|�ꋈ��|X7v���&����v���y��1����|�y� �̔F��_*��t��;̍S��+6�A�VjD`�R;K��VH+���=������{ҹ�E,|u;;��pfԑ�.��M6L���������{n=�H��@ԧ��<�7+���7}x0@ݾP������L��}��2{+a�g��O�LS/�) ��o���TJ�����\�T�FM���,P��E�|����Ϲ|��� 9�N�!^6�T���+���N�hpQȼb��B�YS��� �/��|��� �H$�^�������0#�X����Rh��諁�}�ôG�gt3.�.�y6�!Է~����JBNٞa�(���S�����i��ZL������ U2�?W�*��IϗP&�p`ɮ�m�k�UP���r?˜R(�`^��D��B�6�!�q� u� ���Վ�Z�,��d35]v� ��/�wֿ���B���C�B�cw�����8�}�y�OW�Η����4a�E� =!y�P!��ׅ�8�jG:�9���L���6s����������%b��%G�p��d�(G~��D:(��bmQ�(��` �T��Y���Z�A����Ŏ5����Mb���ݼ����U[��>4� ě��dC�Nw�鸤�(꤯�?"��I�@���{�����"әy����9��KU�w��L3����n[����?�Ѯ�j'�AR�Ob���L3���7yP�Y��(=� ݁��vT=-��][R�-���a!؊C���1Y�����<�t��<̬&���+� &2� -� �'�������'-������ް�}�3���B �6bk���C{:֊��uN�|�I�j�Og�e�?��>Dǚ&�Q�D7>�~m�C'� ��z& O~��-�\�_�¼����)�:���Q��F_Bdg�|�&uշgֵ� а��ōz��9A�ҩ�z�!P�<�a�n�?Hl�UU�7�^�s�Z���N�+*�J������'6#�� 7x�"I��v�Q����u>�� �������B-c�&�^d�y�W;��|ǿ���(�NǮHiX��`��![$t�&W��h����h�#�j��W�80c�G:c<�� 1uރ���(���ڹo}�R\x�e�����p��r�(S��撃�Yh�TԂ"��2�o|9�;3S�yy��\�9�m۰V�����(�0^��){́����J����!$D��ڑM۰9�?�ż��v*d$���S ��3�p`�0�%�X�@E�T,O��fC���o?"t%�b�Ǔ����.�5��2���`$���DȠ�H�x�r�e�D��E�w��l��q��Qh?���WL(3Is���� 9���L^���<�e����5��ޕ�>�:N��QaZ��X��6e!}B��~PQ��0A������kA$�o�Dp$���Q]�ksV��9��=�����cjWz��M0�a�d, �9�W*���+��Ŭ�C�q��oT����d��C�(ZN_� l��EI��ӑ���Jr��j�p�n~��z�V�+C�W�S��i��Owv��b��X#���`��� ��LwK`���h���2� ����L�5�!;��$˶�Ƥ�S��l2�kDLj�Ŝ�=�|����r���ƺˬ��+,�_��h�Y*.i$���F{Lq-�SH�C ���$K%���D��ՕX���s������c�ᒇѶ��Va���"'S !9���?D[]���3�x����K�D�|��1D�cަ}����|�����%٥��{R� P�$%/�1�����r)�x^j���L/b�Lle�M���mSﴵ��n�<0�,d���ԕj�L��'O}�W=
Behavioral task
behavioral1
Sample
819117027b6d46881f3ce8710faa7a3e4ca2e62a2a0716acf3a94d2fa8910b22.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
819117027b6d46881f3ce8710faa7a3e4ca2e62a2a0716acf3a94d2fa8910b22.exe
Resource
win10v2004-20220901-en
General
-
Target
819117027b6d46881f3ce8710faa7a3e4ca2e62a2a0716acf3a94d2fa8910b22
-
Size
128KB
-
MD5
eda975fe6b3927e6dfd1e05f9696a52f
-
SHA1
edeb1f967e79dd3a47e4eeef211838f9b971e40d
-
SHA256
819117027b6d46881f3ce8710faa7a3e4ca2e62a2a0716acf3a94d2fa8910b22
-
SHA512
c9a4d5b13a2d8e24e5edfdbeca31b9688863976397718e1cffc962c00f1bd9c4c10de0f3831ff8b951f25b345d6d42108e783716f660ceab435c672ed57e5c46
-
SSDEEP
3072:qqp/3W5thFdH/muXyadY8pF89Xyt/lsrTxSYBuMCZB:q+e5ZUuiMhF89eoTUYkxT
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
819117027b6d46881f3ce8710faa7a3e4ca2e62a2a0716acf3a94d2fa8910b22.exe windows x86
81f249549852099ec79624363293b608
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
_CxxThrowException
comctl32
InitCommonControlsEx
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 108KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ