9��:W� ������������"(�*��L Lb!(iߴσ&'](�D#<2��Q�ה��|�òh7_~��t\�G�y�}O��kv��Z"@���������T�ǡ<����E& ��m�*$�/���a�v��o*��M��A���Wo01��ˏ�9��q��<y_��͂ g�a� *���)����c�B����K;�[%���q�"��M[��r�v��r^�]�m�!j'���j3��������U�!P_�:]Qi�����х�bA:p�~9����7Dk�lr{PF15��ԩ�FČ��]C����ыm����'�}~��\�َ��jŸ�l��V����BӞ����O3kW�2f�ᗦ�* **[���UkG:$4v�Y[��[�v�+t�w �Ց!�˪{���6�ܤ至k�������OS$xGAF�w�V.r����os�X#m���4<���g�����\�F yC�����0~au�RZ�f�x�]�@�T��]wZP\���V��$�a7/hXb:9X�M�; ���{�]� �P�n<�Pv$�h�;�^�%n�Wp�g�"Z���Yc'%�����o������`44l���_Q��4OOV\Ե N�&\U�ψ��c�?�<����Ϩj=�N��`ӵ���ؿ1�l`��;���Rp��H!��I?G���S@�UT��Ec���(>*=++�B�x'��hXYW̦�[`�O�3�oY�s�m��% �m��;�}[A���k���zj(�:;���i������t ��~��;�z�Z��c����w.��UB��E�%���W+�mI�//ْ���@)�"Y����.��Ʊ`3c���9V�e����Y���ws�QسDF��^<����E kգa��-���Ul&�@�5`j��L���l�4ē��gHE�b���9����c=M$���L��1��k�5�Z��"�B L�� K]��$���h���c��p��9�A*Qz�럡�=����!��r�a�P�T��}�?��⸙Z-)dN1 �;r���:��][[�u���X��P���7@�Dz�:K'eZ��8\h�2s״����/�����/� �Z^xX��szJ�=� W��̡ �4i�F��i�6TD�iK."]�0��)����ɒ�YёG3�!M�]&���m!\�A�ƛ��3�|��명C�ae�-�5%��γ�Ar�C�x)'��5G���j�� �U�=:F�pC��eM��0З�H/��8�Κ�2}��*��VK*�.U�՞���c1$n�������>���yg�9}�/��3��(|(`����/�p���f��`-:�_*@\�E����g���.Ot�����||��4> #�m"�Цh��U�6v��3Y�5?�J4�����2{���� A]�-��ԡr�.a˒8�e&8s��� �5�̦^ћ��6�3Ah��e�,"?��p92�K���A[���5=�����F�ʂJړ<�P����l��7�I# ����;����0W�.�G��V�>��@j��6'P�^�ʻC��[^Lx^��X�j9;���Yj�vI,h��L��>^��G}�&OaX�@�}�����(���̃&6Z<@ي���].|P�F��pиN\���G��'��&6S�˙r{�DQ���n���R�j�;�nϛv��,��I�Y���c�Von I�>����V��8]��h�]���f>4��v�h#�����ҽ�-�R����Rtui�J��-F��!Ŭ8��\<�>�q�&;T���=����C�� m)��a�6�=S�8���G��e֎1��D�<�A~mHp�v1�~�H�J�^��l�P�G͝�H 3&!�X�Q/��ެ�}�Y��yH0v0?�W��dz&x)�M�����EF�Clί?]x��}�xw��0�n�B���`�8?אcc�GN�O8R���)-[��E��(��6M�APv���4lV��/L�����V��%vO�r�Ww�`C��7����h`LƇm�zRɨ��;��>���I�9ʋ�Q�Vj�#m��2T�m�|�D�b5ag��n�������������|�XӸ���>�����%���ׇ|�k� +���J��(B��s}l�l3de��D}�1��Q�pE�'vِ����Δ��ON$�Ky�ѧ���L>~J[L�u�~uB3xb�8�a9#>B��p���R���O �7�(:E��N��z�H�PL�m*/4Ν�@��9�_%��)�����0�Z9�C�+����9�۵���z��$S���W�O���q�1���l�$�]��;��D�_�дX���^lt���")���`�_���+txxɵ�Vr�B����>��Xc����A�"?N�|4���q3X��b�ܗ�6�I�$�Ќ:ۋ�j�Wa(���~��մ7����3Ʀ��B0]'n� �(�4+���>���IkƏ���6�'O[��iQ���&_����������]�©�歅k���*X��}��ͳ��ɺ�-�5�v��MR$�Y@�,lyh���w1��I������ [<v�j��t���x�-�����)��{�J}̬�m����<��['�U2���`���+vsN�<��H�wJf]�D4��L]�FH\�� ��<��f�"mU�o�K�|��=���*b�ae'ī�IAoBs�]<6 I$hb�*?�,��x]p&x_��ye�o���FZ�G���%�������P~�g����CT��@����{��g$�x$ʐsgW����ܘ �������h����%W�O��]��~% }8e]�2 ���o��������L�(�Ht�D�8f�\�˴6�ͤ���F���d����ĩ�V�� L�̣��k����-���?̷6 _��:�����NK�*s���%���8�C����E��:^01�� ���lݯ7�]�6�>]!��n謧5�u۬���@�0��)�Y^�q�u�f\ ���_�>��4���pwcE��F�<.��|��Ԥh:ɳ��� �A"�2a�T����LK���B�ҹ�E�6��"�&��^���x
Behavioral task
behavioral1
Sample
9237e151ce68be399d05595db5ea3c577aa8a265a0516369079f1c195bbabafd.exe
Resource
win7-20220812-en
General
-
Target
9237e151ce68be399d05595db5ea3c577aa8a265a0516369079f1c195bbabafd
-
Size
378KB
-
MD5
36ce498f192479c0193a3ab96261d77d
-
SHA1
1bf6b5dfa84924a69d8f0781bd2fdfa481bfa564
-
SHA256
9237e151ce68be399d05595db5ea3c577aa8a265a0516369079f1c195bbabafd
-
SHA512
c307b5335347de73199227183f48252fa8125ad108afd271b18a755aa53d7cf7b0af2c60f2c7a4f210637fcb04356fc1a20c985f33d0cc418c8f8ada4b7fe441
-
SSDEEP
6144:AFvh+hfm0V2kdtSjBActlgLdwpWf9B4pJ8gBtBKK8UOEztTPdLPtN3jPUGFIgKNB:uvIhfhV2QCPtlgRwpU+J8qBKKFOwpV3Y
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9237e151ce68be399d05595db5ea3c577aa8a265a0516369079f1c195bbabafd.exe windows x86
00b8aade5495620b5f2101ada9d65acc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleFileNameA
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
msvcrt
__CxxFrameHandler
_exit
_XcptFilter
exit
memset
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_acmdln
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 754B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 375KB - Virtual size: 374KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ