jz�@G� �%�g9�F"Tت�C��;�� �z�� �D#i�V-�v����LMqrn�?AQ�)xO3�����f����wc?L�U"�~�b�a�}����*=w��]6T�ڴ��%�]��߳�O�L`�qu�W��[\�=��oJ�����u�^2�?�N��V���ꛆ����/���&�:]M`S���x��ߵ���<���AH�Y=�i��k2�^���lmO3�_�6WK�R�7�V��쩴����~4����O�m�����$�*���!;����b$��yI�|�c��`���@U�^8|�vw�4�Kx�`0���N�xo��QG��ʌ$�95.k��U�����)��̨�W���0��;Cv'A�m��Q .)U]������t�=)�ɴ�5�� �V9���q���O!�k�!,uU�a������R1�(K��vH�=@h���j��:X �G@�����,V��7+�i���L�Qr�n�H�p6��l �n.z��w�I��`��N[�a�^&F$}| �6�lJl:� gEK�xS:`j��������%y���Ve||*>�P@>x�Q;��O,�(�"D}��a�S����I�)����uv�WO#���@�7�5ij�F�`���2��j�qk�#|�VI�����2ʗ_�����t���}+�*ٿ����KVЊ~��o�@���!CB ����O��̫}�����l�!�;�F�Q�����m� �[H�s_;i.xw0�^h&��ɏ �%G����=}�r��5��S�,����m�Wl$��&�?�(z�ˇ*�N9y� ����,hx��u�|#����Y�}-}�`5�L��'��[V/K����<�V�{R�K���ؿ%���8��a�-�SDjF�?�<���cF��{�ӆ��NUD���>/���9����a|�����*�%x15������)�E {��� ��7l�o%5#4����"��0l�dΔ�� ��~$A��G.�y�;7��G20�͗�m�e�Qݐ��VZ��&���\XꏡKq,.� MNsR�y@ӊD�t�ݷ���L5'�S@�N�h��j�Ƹifx) ]��hp����2���%�]kw��T�3(d�m���I���jZ������ED�66,�Ͷb����W\e�<��u�JK>A�RQ�ROV��,m��<]c��"!��\2A�����'���|C�ѹ���ʡk�i�l����,��]�X� ������W:s�bv�ն�i��~p�����p�����,��C�sA8�n;��iO'VU0�tLt$���G|:��5[��gE{�g֦eM��l`q���,�s���ۉ��F} ��?: P�)T��_��d�x/� ��L(���D��4��xo��LjZ��Y"RNU�e�n����n>�Q�}�w��N+C[�i�z�-����L�R�e�ũ�n�~���9����fR5�&�c���4���g��o�^M ��bj��S���>%�)"��0�_��v��]� 6Uɏ���Ds��v(�q!��d��vvߊ\1VS���R�=�l,NB�^����&3`deܑi��qnDjQX_�{�3��8�x ����b�V3FW?R���-���W�;�LL�2� �د���9�O�n��m[쾬Q=������������K �����Q㲌�f�V#�Y��Q�VR_�q�!0����̦@�_�=Ͽ�\6OY�' 3��^����Mq��R�y5?����B�$Hِra���FG0P�6�R�I�(����s�߄���b�3�?!g�P�v֦3������ӛ@k}��m����l L��'W�J��^6_�U)��Dg/�e�&8�H��Ht���qul�[����� �U:Pԅ �]��$Q����G�_w��߽,4��3�\fu���d#�' ��ao��\�A'�=g�����H6�1�\�Z��x] 0��H��2�s����S%����B��4�K�b�/�O��\��X^��aE�B&�h)e�����x8D����� �ٵ�l0���˝���PW�L_�uC��8n��9xj���I� _0����~I�cC�4���zv�S̾S�;�5��x��&E�6����\��m�K ����e�el�3�=��V ���\��V;]{s�z7�Io�qׅ�d�І�ρM���Ѵ�q��D����R�h�V�Ѭ���m@�����[��i���@ݨ��̀�l���>|�%�.Ӂ^��N��-��x㉳Vߴr)H��K���up���c�OM�R̴t�'��`Sʅ��"Vʏ��ͱ+�����ˌ�|�'�9V�7���bL23Ϛ) �eDH�A��:E�FZ7�m��Ɠ�P�XyV)M�� ����*��ďWa����>'f���K���I����1���E�8x���4�N�ç���sؘFM\C(`��LS�!�M�E���4!��k�c���w��T��0:��������m��ER�3�[j�X s1C��v��jP{�U�,����>H�N����Da?��ײi�E�z*�"?�y�jQ�Aa��>��v��Xc�h�����GDL�2*N�hoj�Ss,J���漜|�:����f©ve��7䟠c�X4b�'M��"RO$�S�S���9�{l*K��O ��j(.��"�Q�|�j� ��q�����Q��(K�����.w�#��� �L�nIm������g�31ϑ�ڐXN[j�����D�b�<Xo,ؕ/}�����o?� ��d����~@q|�5��Ru�3J6�ΫP"�<m��g(�0�ye��2��{�rI3�5�m+�͛�)�o|ג<,�J����n�4d;�;���T�*�H��KU�M�jo ݑ\SR��}U�U�J����X?�;��NB���ɼb���@w��Y�|ޮԦ �h�(�Lj�\Җ�xm~P,��;����"A��}�<�SG�hR%M�����+f��/�����Ago�`�h�yy��?���c@�ao�J�X-��z�6��X�)צ *��o�����ܹ���"q��rW`-�b�e;߷TM����i�3hm6���;k�k�|�[P�=���#��f*�H/]�:D!��z���b��P
Behavioral task
behavioral1
Sample
a88d857fae4fd1d13087e24bbc1d548a5e63ee5695013d9d1580080594837d97.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a88d857fae4fd1d13087e24bbc1d548a5e63ee5695013d9d1580080594837d97.exe
Resource
win10v2004-20220812-en
General
-
Target
a88d857fae4fd1d13087e24bbc1d548a5e63ee5695013d9d1580080594837d97
-
Size
361KB
-
MD5
45c5f99524f6776235533fc849d21f17
-
SHA1
ae070515a7eeb97ef78bc9a3e2c014b4f97b815f
-
SHA256
a88d857fae4fd1d13087e24bbc1d548a5e63ee5695013d9d1580080594837d97
-
SHA512
ef3ca1a11f015fb3ebecbf363f918965d43d0bf333625c078affb721cf7148616758b157048f89627f204bed8fbb003a0705272c07f15d9cad0a1e0451667e4a
-
SSDEEP
6144:biPLIMOXx7jUcTaTEPwHsssLhntRWvhJ6anF5SsvkGxkLAjwYIGo+wjzM7hWqHh:bi/OXx7jUCPFLrAJgSusj3R4fAR
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
a88d857fae4fd1d13087e24bbc1d548a5e63ee5695013d9d1580080594837d97.exe windows x86
6832d4a524676a587510c3f7f48a0cdc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
ReportEventA
oleaut32
SafeArrayPtrOfIndex
mpr
WNetOpenEnumA
version
VerQueryValueA
gdi32
UnrealizeObject
comctl32
ImageList_SetIconSize
shell32
Shell_NotifyIconA
wininet
InternetReadFile
wsock32
WSACleanup
winmm
waveOutWrite
avicap32
capCreateCaptureWindowA
msacm32
acmFormatChooseA
ws2_32
WSAIoctl
Exports
Exports
Sections
.aaaa Size: - Virtual size: 736KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bbbb Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cccc Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dddd Size: - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.eeee Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 354KB - Virtual size: 354KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE