�.,������9�,�z��4{�|�Z��Q��$�c� ������XuW8�)���c���?��f��S}�*o����$��v�g��&�$�5��Z(>����R稐'�`L��aY�["��4~��,�_��Th�F �;�~"���R�� �m�W�I�`��$��=s٭�C��Y����� ���~ڒqkA�aF��k�>��w�Hl�T�y�"*E ��PJ�#�t��JЋB�/��|~��6]��O��;+�As)?�c��A�i5�:t�) ��c�L͍X�z<+��_�#��I|'u8�"��lj���2N�_��W�< ���/)�h^�e��N�� ��ߢ��!�j�[��t�I�����]mf�ĝ�/+���gah:d�$O����s�y[���X=|P��j�ݼ��D�kT��$��I��y��9ٜ��Y� ���n���9��~��˵�c� %l3�A.<@�il���ט���}�O�/ ��C�e�L��@ofwc?,~��<��om~ Ɏ�O"��������tP��r�1~V���E7�X� �R�AI�+���V�HD���;h��w���2��nj:U:T�dbWuÕۼr�16Õh^~�̝p��^��F57�j�� ��m�GdN���]�k���T���4����>�a)Z��p���(�e��Yt��+e� �|�uə�w;�9D�k�V�t^�yDg�V5b�<Q�>y{�2�$����?.h�7����t�ڈНڀoO�U�3�'s=I���`\�����N)��?F��ԉ����xc�(]^��7�8���ʛ1[/~��7��^à�v@�~S:����/���V������;Q�H��L���٠��{٢)i�N%R�����3?�P�����m��+�M��g0���ӎ6���B��v��(Q�:�4��!��[��1��CH��6~&��[���\�˗�V��!� ���Q�r�"mQ���{a������L�l:g�~CHP0�����ݤ���`"����ϻ��+(��R��,�g>��V�h�_[��؝�(�/>������Jɪc����M�>���ڶ ݺ�#�9)�ԣ��CO������uE���`Z��@�!;>����reТd�o�+g���)h�+T0�V��=k|//�$�xh-B`We�q�E�S��{t�p���~��wc Az�s���s=��]�K ����t�i;�K�D,p�ή��㿅�-������&�1]�<_�C,�]���b�td��i�v��/ .Fv"��{����C��/�N�,)3HT�;��o�������dN�ު�����mOZ�ԋ�V�X��,�amXڠ{���v��� ���B�(���}x��Y�`#k��-�_�J�aCd?]3vP���TF�9y9��sB�#���z�!=�y�Mǿ�K���}���Kv����e����1>X��� �,/T���`>�j(�q�7��oS�ڼ� zfP�/�*�p�uܲ���DO�x�'�&�ߧ�#�g����ػ��q� '���hު}r�z���� ��+�Iˋ�L�*�0m ��n���o-�#��4"Gj[/-�Z�� ���)� V���YޤE��O��N�����NV��0��f�8���dKn�I�l@�2�H�5���+9L��hq�����U!�^�X|�a�2|<>��ۃ�9r��P������ȸu�zQ�RZ�/o� �jS�h����5b+l,U��&Zv�=V;}���[��1����]I���y���f z�s ���7 ��%�.���D��O�_�]�O��Y��ݓ�K~�4���3a;��j�A0�uFw1��mqx�׆'}=ox�`hԵ����/�'�Vn����j�I1���Uw���{^BFD���t-�n7G�@wI3��KZ�l�T���^;�����'�b>)���@�j_ZΚ����z$]E^�yӵ�eC��P�g��^�����É��s������y?����XN�ٗ�N� .���콨�����,�>��� 鈵��C���������<7D���bwY���k����h|o�1Z6��qtQ��К6�&���[����Pә2�/k0�8�X8�lV�,[�/8�V����}�X�JJ)�����o��aGd��7�CxGm��c�f��h�������I/F�� �f2�0���#��Z�t���%�*�Fq� ����/�eޝ�.�vG�A�'�,v�~��F��6ELK$O�%lF����*�����t���Y�%Es���~-T��8�PK�e}:�:W�8��q� m���3?�c��ޯ���SA�:Ms�`�9n�L�����(���@��)���]����8ن��'��Y���1�Ǫ��h���@舝5xW'猊{��Y�F��rjCWl?=sꥑ����i����?.ȂZШļ��eqf�(�B��{(�(]ed�_t�����F;q~9�^kb`�4K�}ݕZcI��\@��1{�4"�-)���ԟΩ����)�5���4ȇ�+�ƨ���5�5�Z-�w�rUa��=�:\�2�ߵ���Q�嘚�復�g��}�|Uʉ4�)F��Է ���X�s�����(/���N6�H��2pg�3��KKg�Ab�v�O���tk{�(r���$͕���BX��4+�� ;��V��q��D���L�v鑦�'�>��i~������p�\��>�,a0�f��RZxU��$�H�]��q��ժ�������؍%�����5����I�Wz�O\���C�wٛ����SIQ`Zl�7 q`�8���o������X�E�k�$�r�T�Dr�\��\�i�F/K����&-#ˣ�� �����z^�a��A��b�e2���g�Q�K�8����K�c{ϝ��W���߱E�>�_{0���&t칧��cN��r���M�/��ߒ���Vj*j���A�:�Oz5��r4��,��<A�6�al�����W�5�[( ��G��X9#1d����y�/0�1�mGlЗ<�Ǖ��pA����]!�D����U>�����}���[�#&톂��!ҩ����
Behavioral task
behavioral1
Sample
f812780ef989e4ace6a9a96a7ba137edb9908e0a2a3331e32ceb02163bad6332.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f812780ef989e4ace6a9a96a7ba137edb9908e0a2a3331e32ceb02163bad6332.exe
Resource
win10v2004-20221111-en
General
-
Target
f812780ef989e4ace6a9a96a7ba137edb9908e0a2a3331e32ceb02163bad6332
-
Size
716KB
-
MD5
f6afd03e5817dce75642fb7b136d98e6
-
SHA1
e6d2489defcc419bd7cf56d10c0f8dc9ab77c162
-
SHA256
f812780ef989e4ace6a9a96a7ba137edb9908e0a2a3331e32ceb02163bad6332
-
SHA512
4aafb6afbd0d03b85dfad309b9c0fc76a5e26dd413b9fa0a75c60c5f2a628c3a0e53f68609951b4f5d15b14f65fe8cd33bbff0ac9e29470e7480a688e3a7386f
-
SSDEEP
12288:YUgeVDWR6xc+FH2ACUMtlzoJDBbqLm3kFsMJhjIHYP:YNG46xc+FzMtl0JDBbqLm3m9XP
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
f812780ef989e4ace6a9a96a7ba137edb9908e0a2a3331e32ceb02163bad6332.exe windows x86
4cd887763b5ba7c33676ce7251dd4a4a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord645
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 668KB - Virtual size: 666KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE