��~��y�V<�+��#�*M�>e��4�7J���`��i�wOW�:��t߮l�����?4H�wC�E�}JG�渖;ߪ��We�l5q>�K�a�`�q9T��}�!�����ȣ����Xoc���>�1Dݐ���d�I��KF_s�<��58 q��k���X#�g�f�2}��G��=�_qe��_8���\�D*5�hΚI(t����!�L)}�*�I�k�]���1�1M�G�&�9��g�.�Td@��U|��9�N[����Jظ�d�����X��4���6K�QAv�S�����5Y���Ic�/� r�G���4�]\MfA�.��ҡ7��Q&�����.�T��Q��}ް ��9��ٖ�ͤ��,a՟��#xޒé&��'����a���r���>�C1q-p�l���]�d&�;Z�atȶ�Q*���& C�� �(,�u�����_7y���֓�` c&y�V�W+0.sʼn:Y����qu�֭)|5�v��qֺ�m�8.�6���/#G��m2Un�����yT�mV��SC�xg��T�c��5�mw!"��G"E�6�h`����� �%�<Sma[��uS?"�J��.��+�C�9l�$�����C���{����f;,�X���� ҙ��n9vm�F9�N����8�YF�ӴU�}�S��S��� �jڙfG���F����_����"R~Hl��0���ݗ��1�R�%�ˮ}fS�.H��@�7��Rک�g6&1��J�����-�E�� ����c�rBT�$v��� ��D����;��}�u=���g //������� ��C~e��"6r����Q�����YE�9;��DQ�t�4dwr���Hd{�!0k ����eg{e �n7�)�6+MR���Y�8ǏՋO.ʌ�QPrU��T���0|I���S ����VmR53�L���D��z�8ޕ��W;˪�����q9#��ņD��4��Q�_�C���)?/� ���-@YqE��Ҡ��T^i�{V,\F�y��[�T5U��e�~��� ~�w{�(wn�)9����%��k�In�N���}&2�@��_���8��F�R\�����5C䩮�igZ����i�}�y9�8��e�z�K:�w�b� ^Zʻ�f��꣹�H͕6ą{���%�ŗz��<�����N&p�V���(NBJ^B��@��z� �Z|�F~^��?Eo %�Dj�~��1|=���}��*���m"�O�a.��(���9�sJL�% [�����^!D[���b��^��.�p7�����]�f�m2D��n�W�,���OI�?A��>���H?8�'��%c��Oբ�I��!L��`�L@?���E ��Ln⏯���|����OMT�^y����x.G0q�n��D�I},>�\pmc���s�R(�?}��f'�'ͳdV�ɝ��W9�^����g%��" @��qrp���[o Пޡ��]�X*%F� ��O�e��Vt���jk��T�] :�4p#N��$�5��P��'�Ӯ�"�l�Ty�ܕZ��\Kѵ�\xRJg0ܥ2W��%o~���~{[_���yX�ݿţ��$.p�����������.)"X)��Զ�x����sK$�R�r�ct�9����TD .^OX�3,F��W%��O��.���N֏78�H�f�>�̫s}}�����<��=6{Dg���As"7i@�����8(E_�=�羾1����q��+CmmeQC O!�U�.��&������3��|�`����8��m��VB�Oh�Է�E�ù�ga����1`�6����H�8(��5ϖ�����9� %�C=Q^Q���>��K��������2$S����?+%b��x�A����[�^������ODe�s����� T�\H����?k��ǂQ���r�\�x��?wԄ��J��'[}ߒ��P�� �� ��má��P����4�^Z �*��Ts'V�>��Ɂ�(� V+3��t3Ιt�36L���4�����R�ࠋ]�10R��P��v�S P������yk�Ji�<R((�� ����dkm��U��l���뿞���a��$)R]�S�(j �7��iB�B�ָ� k2��9������{�5��f~���C�@`�ưcxq��5�r����t���b~��&�5\��1K�(��hEy��i�^ʆ��:�E����F�!ƶE)���L��=�Bҝt:�Ԥ k��j�u-,��L�H���(��+/���@=�?�o����7cȕY��m&��J��P�È���oj��J�Š��Ao��j� �AG�.�{l��]g(-���ŦZ�Td�f VM�2HeU��ITE^��@_�������;�U��\���(�@p�ke!b������ؓ��*�g �}�6�:dr�g������Ot��i���~[XhT�E�� :�*^l�m57��i�����:�^�n>�^��@���DN��0Y��?��I�h^O�!|����Z:� ��'�Y�z�8 ��^_{�"�V��5GY��������Ҡ����(��$�%��8��Ñ>�(���t2���)�I ��PSLy��ù �2=�x��i����V�7epʘ�|B�%��{L��[�eLt��"p�-�\��MT��NPGn����P�UN]9��/$r�G�"�8$���uS-������-����G5�����L�ðgQtv�Kٿ&�ah�H�/i�%�M�����s����T��X>��� �9?��D�u�X��sܹ���#�J�d�3���J0������1�ۿ��C[\teM7��7?�j;�lY&�q�����Y�鐝p/��H�(P��0��^K�~���g=L�@�WqQ���οXi:Ũ�����wX_�z���^��e�#�T��f��5�DW�fT���^���[��vX<�Yt\� ��ޞ���Tb��~%�ژ�NQ�O� ?�G)��ڜ�Wȸ�#,6���XF��a��Q]�2+����d%V4����P��C�@�'��G}��=�t��݃�l A��U�L��;l���l�Ya �����#j�C�T5#��jj�{�>ڑ�F�b�0m�
Behavioral task
behavioral1
Sample
3448f15cf88c7eae32fe0e397e0f87d1e601384b6a718244d72d2c457d91d670.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3448f15cf88c7eae32fe0e397e0f87d1e601384b6a718244d72d2c457d91d670.exe
Resource
win10v2004-20220901-en
General
-
Target
3448f15cf88c7eae32fe0e397e0f87d1e601384b6a718244d72d2c457d91d670
-
Size
684KB
-
MD5
bfe1b028303200ab84410f22ed67d08c
-
SHA1
e3c3ed6ea81e154168d2e03e5637d83eb0132014
-
SHA256
3448f15cf88c7eae32fe0e397e0f87d1e601384b6a718244d72d2c457d91d670
-
SHA512
cd248b9be8ab0e5207819c7ade7f0baeeead4731dd44d103e66bcc294e356210f5847b21fae003e9de1606f3ada89e44d57d5c34a4d192a297520e4f8837a01d
-
SSDEEP
12288:5fo9PX9eAgfOxVAw9BZkIYiaf6QwaCEg+FLxYGsnoP+OiT8j7moy:5Q9YOzAeBZkI3afVw7ElgnlOiT8/5
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
3448f15cf88c7eae32fe0e397e0f87d1e601384b6a718244d72d2c457d91d670.exe windows x86
3922ef0edfeffafb85a042db5d6e4b84
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ProcCallEngine
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 617KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 435KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 668KB - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE