,�!3��%]pY+��a�42ҁ�y��� Nc�bʱ|Z z~ܧ�H3/�K/_��ia����m�fj�k�ܥ/i�X�n�r?;���R�TZ>�Rxu T�W0/�r㩁��q � �6�^���A-��ے!z����l,o��-�x��G �+_o���1�8�H���4]hn�m�e�Y Y��.�Q�P�W'W�� }U�uν���9t����1�\a�e�?z\�f��;�I ����=�d!l��_�ND�n����w��7�q�`>�|L0H�a���!P���H���0��lg�������&W���n�\[��[��d�����,`E��6:!S�BaG�u�7�g<�*�X�7V�~S?���,>�ߦ {��`���H��\��D {�t�)��#���"���Y#�gkzx+Y��� �ad$Džx�/k��_����Ԟ��N�{#���Q%`��jt�,��R|��o�4T�ˍ�m�@������O�1��^��0?�L��>��Ll���Ú��ŭqQ�bI��֭���De�)���+�F5�,ҩ����X��2�+��L<u���f��^����ҽ\z{o���[�:p���^�Pʟ)�<�#l.^��ɔ+�q'�9ܠb+gQid\�ƭK���D��i`�S�(�si8�1~z��d6�����V/iڋ���,��g��aH�ŷc�a�bh�%�h�C,��l��;��j�ꥂ�5<p��;���m�D�j�udv��;��P���=��5i���*,E��9�JF�P>�����C�.�<- E"P�B$Wr@8A$ڭ�����>]ޖ"�� �"^�v����^K��rx�R�ez�S��/�����\jz\E�{�⫔�y3�U ����DP k��yl��SM��#�����ٙ�1�oagCV9��%�_�֧�K����i�azv~8�#�i�)#��v�B��͉[��Y8&=~�&�?y����L�����x �m��CYxT,�������F��#"��o�'����;2�z #�;ay�W��-�k�(�j ���DW��cu��JZ����U%C�7�wH�&G%&n\�����^ O�I|XYm e�ڔ<�v�U�Z����;�J���܆�%���!���-���������\�7��v�5Z>r�y3��C��_����N:���;Z�@^�s^<*�4������F1�*�h��ھ��u��?��/8P&s@�;�S�%��liٌ��aa+�:���sZA�����N �Z"_�JX�W6��)�� ��]����Q�� �[��#T�0R_a�Ą��&;�����h&0 >���+~[�#���LQ���: ��a2�Y.V`�L�ԗpLv�2��6��]���P�w(��nZ�xw���}�@Y�tx�d �ŧc�,�YZ�J���s�"9F�#+3Dn��}�@3�iT�D�(X��6odU�[jc1����%�'�Ɲ������l����bm�%���N��{���u4���L�l{v�G������,tB�5���9��� ���y�������]T�Ԋ�̪&����T!)�`�^���X:����!V�.N��LG� Y,γ�7���]aN��g����H1�����ö,{��ӗvz�p]��cy�I�=ڌ���"�3%m}�seZ"i�Ei%���@�V�*��ltx;&��.��H5����%\������"�1l=l����%Fgfze\�!&v(��!�/U6��1�8��'��A��ۣ��J�4����}NLz�̢�����aFt^�_6�C�������(c@y���O�r�e�*ŷ#"R��ԁC�Vb������ʷm������p ~�������tK�p��/[&���Mnx A.8�W����G1�p�?�8�������[r��x����ޓ���jKT� �J��J��DoD��Zۤ�Q�"��Q��c}��:������e�k4l�M�òMȊ�?�����(��ۡן�+�{�o&�����3"�2�K��[�2�Fյ�29�9��~�k#�rɡ�pq��|d���_��j}I��r��� 8Ĺ57@c]la�Q��p.�3�3-A����G������B���_�K\Y�R,d�?AZN��a$qL���P�;]+���RI�����F��x���+y���|<s��G���m�Y�iasr��Wu��; [qF�P�q��&r��JR�GO�/b����Fj$1��(_��.�n��/yQ�y<�8�v=�@:��(Nx���r�m� R����s��H��EZ�#|�W�aF'�0�vP�HMd�Z��O��U��nxmg��3x~����ɚ�fk��*�r�#9$�E� �*��ᐞyP�� ��^�?y��U�|�@�rT��I��R��/_��!W7^<r�z�`���R��9��g0�JG�=Z�s�U��Kdx�q�2��Ҍ���5�Jb<�����Ƒ`��u*o�o������UF���+������T ���9��/�L\�H�I�ݵ\bt�^_�VSi���^^��5��C���������䑧�ۻ�3����bm�Ǽ�d �#��&�t�9jW�Z�U����Cz]_�ez��E���4�q�! ��{2�<UZ��i8O�W��iw������n�r�ȓTO)sFڻ�+l-P ��tDV5�=��3tz9�(}?�E}Q6W�Z����~�^���oýʛ2�i�ij���f���Z:�ueNB�]A9��S:XdfZ/9.b�q�G ��"�~Gݕ�����xW�o���iV ��9oF� Du ����j�h=!����_�5%�b��sWc��疽[SS��j��C�|�����n���e*���!q���4��%+��|�A؋�,b>5��������齖q#k��>v�h+�g�Oٞ� {4H��t]������>��N<��*�,@3Q����끌���p��t�q*@>�����3t��4N ���r�S�OET��8 ��~�T��F��շ���Y��j�$�u5l���rر���+��o��+ȷC
Behavioral task
behavioral1
Sample
ab1c6a86eda3f92d409c92095e7a388066463c04500e915c1be70fc441b79c17.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ab1c6a86eda3f92d409c92095e7a388066463c04500e915c1be70fc441b79c17.exe
Resource
win10v2004-20220812-en
General
-
Target
ab1c6a86eda3f92d409c92095e7a388066463c04500e915c1be70fc441b79c17
-
Size
724KB
-
MD5
e1501744ea6a1b1c89b474c17ea5b068
-
SHA1
c35e3d67c14478f1dfa9efbddc2dc2dea8c43e0f
-
SHA256
ab1c6a86eda3f92d409c92095e7a388066463c04500e915c1be70fc441b79c17
-
SHA512
48050161150a1f86e5c1016dc6da24149a44ea856703fd27775aea63ba386f2b0f8131d58b1119cf8e82da64377b3438f7b62bba500de4715f755e0f893f1c10
-
SSDEEP
12288:2nWKHTmFEXclecbhgtZW+YfzAy7P9q2DUMxKFfLW0Xy:qZzcbhgtZmw2DUMxILDX
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ab1c6a86eda3f92d409c92095e7a388066463c04500e915c1be70fc441b79c17.exe windows x86
5918a9e8884b77c976c65811bbfe40c7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord613
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 712KB - Virtual size: 711KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE