Þ�:���V��=O���M�JҢtNl�ˣ�N%9 ��As�⮯�}p��&GV��g�k�xv3�2U�5@��@���4h�_�`�A��A�-����� ��-�|_}��;R 雸�;7�w6�>tj�'����<��� O��k��r҇5��5��ة��@�F��"�XK�2���|�0X����iP^~h�_q\�� X��f"G��}�C%f��W��Ó"�&�%������5�"��0��{����X�R�p��_�,��X?x�%L^X�7 SDP�C�=��0�m�ۯ���L|�P�K Ix1Zz�&���:��B��H��hYl�z��ю��З4�������_A��ל0����گ�N�(�g��у.�w0g�'f6"�u87�PI��۫Kuo8�=�lK��6�`PD�aC;d'qP����\L�Bo�#�|s��a0�o�}ou�~*`4� ���=Rݛ6DЌ1&�gxZ��F7��'zI�D��W9�ъ ݂s��!�v�2�s~>�O�e�����M�-A*a�˵D�q�)^��?�zH��B=[��}:A���y�N�Y�呦�RQ�6g���.�n��ơ@�k%��?NN�z:���rX6�j!�A�[�h^)��m����n���a��L{%B�<�w�Y�z2:�d���$̐�Lܓ��(k���lV�=h��᚛�{��`��Oo�� �<3�=3;�2�D���R���ĢV�n����G�q���j�F&������b��q:����r�j��㩢_��/J��(��R|�$Ũ�j����.��a��St��꓃�;����@����m�o��핕>4d��U��K����OA�-�8�i0�@K�}O����e�{�S�j����Q<ܲ�,?',�]� �ԣϾr/]�4�գ, ��s �hr�lQt�A����, *���"Y9V+�X@�=��H^�R�,P�[<��N��!�6`]��f|��㾥Sv��Y�3��u�~#$����1�[+ �/������<㉒̍��`<,A�`F�D0$X�TI�w����>[j��V>}�%�K�}}�1�������=7�hL��� {��qɺ��N��8;R~K"�~�6��i@��N�+��dZ`��C�#�+�L��j� �5/��yD&�_r_Ƚ��'��;W���_*i@a+C�/U��U�"��7��hf\ބyGV?�.Ii{֍~Rd�����O��o����/���2�ҴQ��ME�$� 3��AT������^T��p�5�>����v�%y���-a4����=�D�Z)����<�6E�Ӑ�&��"?�U�ATM���FD��%�+`r�C�c b�YdA|Qm�K��>��!�N�r�-����{��y�Z���'���e�Z�m���(��«i��S���9\���Y�z\ؐi�s��%�����f���A-,� �)_�ϋ�?߅��a8�f��`�w�.�����K#8���e �g-�"��nqYf�W�k?1������X+����D3�� ��\f�s*mq��s��y�� �䲬�!�M�\j�>�#��Sz�mV���� R#��Us[w��[�� ��r�(g�)� '�`���!#s���hZr�2�'�Vx���e��NF�"rQ������ӵ71q8�3o��N��O(�Cj�-?V&�!���}P>�Ɩ�,�GQ�$f�'Sc��ԣe�MvC��Ć����zY ۹.�: ���B#������pO�#S�&�<�����lr��tUʐweӝ��5�T}8y���Ł���1m�E!&��? B%�[���خ6 \!O�.�C�ĵC��s���� �w!^f�z��>y�tT2E�I�[�~�o$��"�F�|٢��ݸ����5�ӟ���rZ��w:�cYy���J.��堪��aO�֧�&�K�!��:������|7������N����'�J�3yH ,�* �#bY�җ*��������7��WL��@>sv�5�#6��\��nMO�ŨJ����|��VYHK��y�U��E�V���GJ��x���;�ė T!?�겹��q{��� �-���U�6�#��( ��${�Y��H���R^z5��B<�Dq��Z��XrK��X>���������a��N D��X�p���`+\Ȓ��B����[:e��et��Y�vڼ_!��&���N�o�|��}6���@ա-0�\0|pA���˂k���mQ��~��������rd���3�D��s��.�}N�k�r7F��P=�;vz,��6^�L�6Kj��3��a���t�� ZH���Fm�e�a����1"�\�!���Um���I��m~����"�uRdjj��y�-���QƄxT�E�,2i��}��������=-$���'���X�W��7%=�j_��$��aZ�|,nV�n��˴�#�m7P���R��wΨ`�{�U���a$>l62�o���j_y/l��u�ո/�����"��(��� ��O���k~�>V��q�p�j���z��l���X�Пr��oU8Su�w��=��aZ��V�����}�W]#����pGM\�����xh��~��I�������\��J�g0��!d�$�Óm'��z���S�%K��U���Y��Q/@��A���.����B��������0��w��2����Ҁ��ѓ��\�/]��Iyo����˵�cJv��~��;8�v���l��o�����.?S*��m8s�P:�B����AK%�&Z8�j&�wW6ā SM#�p?#}�s���)eU��A����S� F��}mm��V�*3Q�4��#�c�t�j�����u�C˛�0�@;r����|��i^�*x$x0�[�S��W�؇"��G�v�4��fn8�Mh�|ۘ�������wJU��E��A�Oԭ����@ ?�_�%<��OԈ7��O.�9'�cz7�"sɀ��51Q����Ny� ��C�DM����0c�xìTB���\�z�Y�q6O�@�XuPU�xE�h�]܅Z�8��ۆI��i�#G]iH��8G����S�^.s��D����y�_'�ʷ<mb��
Behavioral task
behavioral1
Sample
d693c39673ec6036a9ad4140b12d83a31093971551f74df04d8adb768d9ed26b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d693c39673ec6036a9ad4140b12d83a31093971551f74df04d8adb768d9ed26b.exe
Resource
win10v2004-20221111-en
General
-
Target
d693c39673ec6036a9ad4140b12d83a31093971551f74df04d8adb768d9ed26b
-
Size
688KB
-
MD5
4446bb473e524475ef8c308526ba1f69
-
SHA1
6cbf9c858abb2c30eec8049f6b07575bfb8334e6
-
SHA256
d693c39673ec6036a9ad4140b12d83a31093971551f74df04d8adb768d9ed26b
-
SHA512
dd648884d9bb3269e0474f85727fa085ff1d4fd81cb89e0b4695265e52a5e73e557c26ff1c0cf4c4cde369b3d2b4cd93bb4a155deb5dc42e6b1e27fbddcc3bdd
-
SSDEEP
12288:bKkgHlcS/SO2BO6mjlGP6IMSna0Hq277F79UvOGXuh6qyZ4cBLSR+Sh7memvF:ekSlIE6mjs57al277FpNoi6q69SRi
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
d693c39673ec6036a9ad4140b12d83a31093971551f74df04d8adb768d9ed26b.exe windows x86
9a08fe8aa916a42fa2b3f95042fa7ea3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord614
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 622KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 672KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE