�o��.0�P"�=����^��۸8�pFr3x��>��]t��� vs��2b�J^C�J� 4���)z;v+Z�="{P廠�z������&9*Ό�b+ 1d0���[y�8lO��� ����"Jf�z>ANE�:�+p�X�T��I��Մ34_J ��� Ǖ>Rp�-PY�.��XAky`p;8!���t��e�+�����#Bq���O�(�ͭ���J�Z��ZK�q�bDŽ ��:@�A��@(+T��3���i�^��#=�0v�[=Y��A-�rbG{���u�i,��,t]*Ā��6}V��?k���__�5�a�����"�ZguJs$0��ڣ�<lu ��QE�ҝ�іq�g�C����ؑ��.�o��,���R'��-c�����x���I�!�����PZ�I �i܊��"���\iS[�Xh�B�2)����E��"~5���Fv0�2Ð������Ƕ����b&e���bu��� ��!�\t�g���:�B9��8�2l\�ePܬ�] &�2t�B��v0]M�W��M�� ci7��g�M��II��K����eE��m�U_�Y���p�.|h�����AAuu~�D�� N���{��/M����u���BGZ��� ���@���i^�:��O�O�ڹ�O�v[l�v)b�`9�z�8��3=Tj�>猝`�n�M(~]KVh���l�fP�7^�-��3[���� ڻ�tC;7������U|}��?6�0'�<l��|,�?�H(�k����9��tVfhM����Hj��4jc',˽� ����cnM uatQr��-P��c��>��L�x����3@[Ze3�#� ��?�?Ο�k��Of'ɏ��C���w�/���� ��"Z�*Ў�E,>隄����1�@��c�.8�d��������<z����!����g��G�a_�K)(�Z�M����e �dC�rtA�f����/�[��S�L�<|3���ū�AyQ��t����Syo[� ���Kڔ�rO�_8vY��8U�s�'i������b+�w_ݚy�`�pIJ+.3C��7���X. �j��:X����@2��[!���na��c���F��{L�o�_s�#��Gʴˑ#Z�=�� o��"4�q"�W�7<}�;̣��pU�B�����EZ\�ɲV9�j��^���ϩ�Z�값�隸<��lY����J�n�.$����,Z��Ќ=cDe��,��c8w�����q� i�zn/��G �2P���Z& ��n'���a�]�*{��!m)�2���p� W '��FQ�����@|8,�!���.Ro6�]�Lx�5��T�0���/���B{V�KBµ]�g���@�����h��G�~�oI˩����;�{�ί)c/nѥVٞ��X�"�{U�F��0���b��� ����=�W���)�ѱy��V���:�c��ڳ�p*��l+�ܼ�p�0��Z[�H�O5e��!�����/�8hx:��p��@30iU+��t4��ښEi�@��9E7&LX���T����C�K����8��g�7BC͉��ˮ�G=J���B�6#F�e^!��7�4�2ϧ�z�J:C�����4�h�&@�������?:Ze`��3� �q:{�Fv����f�Kh2��)�d�^�#v�qM�M[V�ÅOm`3r�E� F�[����v� V�-D6 K�C��(�g��TC�t!��r�]���l!-u#��s%Zȫ� L����/�O(U��4rَ��M�#�<�)����h����M맏j���U~F����������A��_�j2���������dR�� �����s�(Tw��$��+� E��/�j�4M]Q�/�G'���ݠ�V� y;'&��u�<T;K��ͧ��X ��~���zD���^�8n�%x�=tekY0��HG����[����ytHE"�W�k�M���r~�aU��ڠ��vd�̽J�j���k/Jj�S�:��Z+�##�D�eR��;1q��/e���\s{:%������/h�� ��Мk-Z[l"��v��?����P��#�Ԋ�睊a���i$����[�źz����$zZ��:u���(��:��_�W��,W*c,h���B@I\��UR��PzC�ڥDfv��o�Hи����*�[�~V��:SU�������Ro�0$�;�E�����.T��ZM�?16��������%b�aA�H��y�����"|�B���T�3�Ghw?�g�D�[�Z��M�y\��}a��7��k��㢞�������`2b����&keJs��M�O�����_n����.�E�RC<���aW��,ؒҟυ���M�)#����j8�|��|�yFcy��4?a��Q��8וq�j��'ݎ{fY����vu��o$�hYk���ŁW�mWw�CJh�(�Cm�Gh".�����,G��^��2펉A��o?m�~���l����*����n�tl!�yN���%ԁ�&[�&dKm��(�(R7��gD�l�;:}���x~&�3�T���W �eNT��D�������M�b�2����t�n��윴���r�is��'!eoi̝8}�ȳn�F�A��t���`����Pe+^ �� ���Z��<-jʀ8�4E����H��=�U��i4Uљ�IW�L[ݻ;�� A.�p��꛰�t)�%#J��RT���11�nu M�: ^'D�2SZG,𒐾,W�$�6���CT��pi-�Uk�L2�k0�'��4���Xo,��OC (���*2�o~��Ȳ��6���so�X��^����M���E�e�K}K��5v���c+Kx�Y!Gd��"�Tz�3"��?b�;��L�y|�7���JɎф��/�E4W[�B1�F��/��;��Gg7�+���}7�OM[{�Y?�E�Nj����:F�$��/6Ց����s�V1�T��3^ٙ�-��V�=v��<j'0D>I�V��_�/n�w�'��0��a���K�� 5��bECwC���mU����"�����Uk��)�}<���vՠ`�l������ɖ1 0�O�&�
Behavioral task
behavioral1
Sample
31d2e285cc5895ee6da72aef4bff844cad9bdb2e909738f4fcc4a1d8001c5e06.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
31d2e285cc5895ee6da72aef4bff844cad9bdb2e909738f4fcc4a1d8001c5e06.exe
Resource
win10v2004-20220812-en
General
-
Target
31d2e285cc5895ee6da72aef4bff844cad9bdb2e909738f4fcc4a1d8001c5e06
-
Size
1.3MB
-
MD5
c165d9fe44d5e7de39f951d4bb273114
-
SHA1
297b7d302ad8de5a1c2eae2b04fda715713267d6
-
SHA256
31d2e285cc5895ee6da72aef4bff844cad9bdb2e909738f4fcc4a1d8001c5e06
-
SHA512
de19f63c4c7a03cda8d7bb6187472cb38318df3a43c843e4d2f23abe6520c2f4d2761719179572cb22f7781c23140e1497bd08aacd9964aa943b308357f97337
-
SSDEEP
24576:5yXmsLFZOEKfH7E3LHj5e5us7TXnuvJjHe4BpQb44:5r1H7i5ku8XuvJjHe+y
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
31d2e285cc5895ee6da72aef4bff844cad9bdb2e909738f4fcc4a1d8001c5e06.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: 860KB - Virtual size: 858KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 328KB - Virtual size: 325KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 368KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 84KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ