l��9��Ή����(��9�!^�;=�=�rd'����D:~���׀;��hL=����4��SZe�� ��Jqm����Rؿsn@�[�^=R�9+������1��sj���y�'p�C�P����'~+ϒc�.0��֗��igR���n{aO�[;��{���U.�����8 �x�E$ ��q���ed�nu��H�jSO��j�x&��mt�=h�[#��+[s&f�Y,�ވe3^�0!k+w6�ǣ/yrv����3).Q*e�xi����7<��b���/ɳK���$`�K�h���j��U)x#c�>����g����eR�ʟ�2@;��1D����:���y��H��Yu�J3/B�r���s|M�̋ �l�� f�8ȁt,���N��E�@\!U$M�G"�o��9\LƓ��jNE�.�����Dt���r�K���u��M�r#%�=T�zjJ�-��m1!��P����D![���fP�����]���/�3,�+{�w� ���0�#��|�p��I�{�+���?���#�3���s�2K��٦٘�O�N���2B��*�������q=1�ߟ��<׳U�kSZV�f�dhuc�Kؚz����"О�ۭR�;0tGQ�U~�'�=fglj�@R���4��_�v�ZB՟����u�x��=�m�YP뱭GИ��e2ֻ�q4��}������A���z�H�̳�����+�|r�V��]�c�U ��.��C:WM�Lm�|]�����=�if��_h�e����;wbg��U^��� Hh���S���y�R]�y����$�L�iMִ<>��mq���L���[1,�DS�!iL^m�����vv'�BmI�X�$��r����o�lr��7���G����m��.��DĀΞw������g�����qt���Zmܕn�u����9;���r�X��qlj�"� g���� �S�j*�r l:� �7l�`c�5/��N�N�<6���0��(y�2�qQ��������D�����A���Y���4yjPُx0�������L4��0[�dKd<Ћ���@�����}O�q���Hs����������*H������u���9�z��3����`��'�znX/�����b.d;�X���\z�� ޣS8����s9e�bC�3���B=4�q��eJ�u�mw� �<Cv��-:�Y����~Cwv'���*�� �^۽e|ң��o�bF����)䒞�](oF�*��5i���}�F��� `��RFA�Qʉ�'795�@v��ƉLRo��&��S9��{��ј\�ơ$'�9�R[�/S>O3�\������]�)��,�H�Bֵ׀G'�=�w-"U�=��Lj<�c��0R6ܴiI���%�m>���{)O�5�0��Z���Ԩ�+_��[��������$-���YGϋ���8���=�wn����&�0�2$��Y�X�I�r�i�$?5��:�#@�'�uC � 6�/��ˁ��ZgJ��o/�č���T����Iyc������#�d��m���o�e��F-������e'�xF2F\I�}�V����K4� y4����\�BC�b�� ��-K~��Y�*;��x�~0b�$���������<�q�]�� �%1�7b��u�̨7PJe�R�-���z���YV��ge���̣�A�xh�+x�CE�u��������j�F�,^'IPFU���1d�Phzh��������Y����Y��\�D� ��j�w���㉈a�nN��ۯ�����,�H}��A�l��˙�Ĭ�ߜg>|����z6�}^�:�Ap'q�K�6K�k�K��??V�v�%?x Ecc���;��xKU��p�YKS)��T���S:A���L~��0743�4� 6����$��U:܇�WJE��i� bG�Sj�nÐӏ0�F�}�{KY-�kR]����GL�0���+�0�� �tP(����Š�"�p/܆&v�����]E��� �W��;��x��Q^�X��� fOʎ\���@����������\L��m���?��qK�ֳ�'�#�u֭�?����p��O�)����ɋ��!!P���$.O�-�f��o?'BrP�=�)��������t,�;�,"���z_�������m�U�M/��o�H��Tu��Msc-�-�N/��\EKO�n� �`�g��V�Z烣4�?X��O���@V�A�{�a��t�pC�T.�Icm��Ӿss�ɒ���6�5%�l>��0!�@0�]���k���6-��k��& ����O����u{��-z�\��d�u�i�&WK@�M��/�0�V�|xX o0멕�'.��������4�kՃr�.��;=�%:��}KPg��q��p!駢�pbu��hKW� ��{�"�V �.��m��Y,o�a1&������n$ݤ_@�U�n�i�҄Wo�L��0����DƔW=j_������ڸ�iL�Rz�<�Z���+5PQ��0��m$�>%qL �`<-��!��I��l��P����'v�Pd�@�?�����P�V� ��ʆ��E��R��� l�F�^J?�i��Si`�?��S�,��1)�˸A��k�������[�M�PҸ���<n��3���R�CWH��1a�;W�8vl�)��?}�dV�����Mn��yM�=����@N�O�f����~�ĭ�٠�]���ET�b�T�y?{�d��D�hS����I�8T��gᓳ���n�j���1,��jD�/�3�ϛ6 ��5��^�������P�=j~�PKU�fc�]�k39l'�b.H �Z(?�EM��N��2`o4�}�(Y��T54P���;t��F�nL�����}]_{�/��ܾP;�rɥ��E�����+��ڮ��T]�3�N�����n�& �����β��k4M�.�z�,��*+vk?U$��� �6���A��$��;bg��3��`�O���a6���)4�� ��d:�{����۔.)�8�R�d��}�����ō�^o�/�$i�}7�
Behavioral task
behavioral1
Sample
babd46c29dd92251a036b617f0bdb74af2d6afb6b626f6d2fab0ee25edba7447.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
babd46c29dd92251a036b617f0bdb74af2d6afb6b626f6d2fab0ee25edba7447.exe
Resource
win10v2004-20220901-en
General
-
Target
babd46c29dd92251a036b617f0bdb74af2d6afb6b626f6d2fab0ee25edba7447
-
Size
980KB
-
MD5
ee5fea9349337c4143a910d043dd9477
-
SHA1
42c97880de35cf3b66fc4fd3344711bad56dd06a
-
SHA256
babd46c29dd92251a036b617f0bdb74af2d6afb6b626f6d2fab0ee25edba7447
-
SHA512
85b166ff5d4591a6fec6acdb71d71efceada9001914ef12791deb2cee6870084f51e71087fb97c33a1cccef357432ac5e55ea8d1edb521a52ea94948389857ad
-
SSDEEP
24576:2xIm2xt95BSAeYvTqrkfz3ZIUwCknm0XwBuT:myxteYv+MppwCMm0XwB
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
babd46c29dd92251a036b617f0bdb74af2d6afb6b626f6d2fab0ee25edba7447.exe windows x86
b2b684db2ff432db7e66fc5b5129f8d7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamClose
ws2_32
WSACleanup
kernel32
LCMapStringW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawFrameControl
gdi32
GetSystemPaletteEntries
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CreateILockBytesOnHGlobal
oleaut32
VariantCopy
comctl32
ord17
oledlg
ord8
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 510KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 416KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 325KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 956KB - Virtual size: 954KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE