�A��M��(L�U�J3#į�����IJ}}p�Ӄ�����'�W��لֵ��!��N��>�E�^[�Xb d�ʾ�[~gA2��p4'>�q5��wDP=^� v[��K���76��m�?d�zD*T�mZ8�_&k!�ŕ5�s3PC<�q�g1 ��G (�Xw����+��"�b���pw/9�� �ϵt��F���U};'��Oc?m�la�C��`�����^�(�����~��zH���Mi��E�D4�c�_��䏾D51��d��C���8�A`�ø����-^����WS�� ������5����}`H%�(�$�P))�̓��Y�� �u��9��V&[��=lr���6f�:��w2F��j��p���G)�� ���H������r��56�1�-���� �77{c[����(m��mY�N���P�l��nn��1+��,������y�t�ۖ�p�#�&.��R �Y���:�h���W�������,'T���DjR`J;-0� Đ���b��L��� �ꤘ-%Ɉ��ӡ �Ϳ���&���Y����F�-ވO�1b�ǣ�>bO��#�!_�া�� �Ju�(��x���&6!Т�[�H��Oއ���l�+�����&4��8v��}nb�j��FnK�5�o�;���D�Eۍ��U���W?qp>Ed���[���+�>�`*�]��,�}��ȟ��pU��2Yư�M��9G*x�5��l�����<�{ծG�-YT�%�`۾��t�{�k�� �_�]�b�f��Z�u�e0�7k��C���V�=*E��x��ol�Vrfet|�.��f�BY�3S�"��m(�ߤ(���,��t�2E+�.����.ט���6��V�eŁ�j��v]��k}0Ki)�V�n�0��A�ԭ��2a�k�Rk��(�O�t���u(���<�c[H��!�R�[�B8��p���?��W���R��(p�d{�qԪ�dՅ�O�2|�\� yj���A�eMZ'�\F������dO��p1�ȴ��`�%@Z5�G���|?�3 QK��D�Yp��L����n���ʦH�))3��:�&��k�a� ����b}G�}��)��AU$����Bܯսk���N��M �W��CZ,�!r.�.ș/�RV�ӓu��,��G�P�D�2�zr�4[S�P�&`O���WD��7��e�/N��7��7F�YK�g!?� �P�O���jc@�HŪ-q�J��Kl�Q��a�uBa1��u�G #�U��M�L�L��X-")��}>���r�[�7�Fk���A ��]������,��}GN�\����}�-�1i��}���#�P��o����(�o��9����D�u��Nm�4�wm���0��:���H�,_!jt9�kϐ�B����z�?�&{�A�_���A�b���Ñ�kj�m��D2�y2�uv�`� ����,����w����4c��v��ԣӨ��7��;�F���^�����Ɂ� ֞�L�va��Qise�g���ЯǾ1�U�֒���z��� �&d��TK��ʢ ���L��C�-�~�`U.�� !o����R2���v����,#����\����PBs�������e����>��{2�5�>������)����]ڴ� �>����eٛf�߯8�p?�E��[���x��!}���CJ�f�b��4�1��i�,.K��|��N���"swt%lVS�,�W����t��;�z[�q�?O�7����}����t7N�:¦�x�y&�̀k�\�}{�7:��[�Y�,q9�n܂�k҂(-�X>Z5Ɔ�A��l��M�6E��$�0�L���߹�>�b��Eޕt߇� ���U��.�H�p��宬����ퟔ�[L��Şm5Zo�x��b��M��ѷ����W�hVfX�mUkt��?�ߍc�崾n���';=�X��Ӧ�)�������1�p������Ӭ�5ɠ�Oi~�D�ɈT)j������`�;�,��FSY?��B/y�#� ;{��xp��I��S��ۑ-�X�� �A��������2��v�'-I2)v+=^yX4��GW��d� �O� 6����.5�D+�,�ϱϟÙ_UP� �(�Ϊp���WZ�g.�+z*�Ǎ?^" ��q��h �ձ��O5�ԭw�k��J>������X�p�x�U�ɔj?Ȱ�*m7k�c�i�TI����|�J��&�B�S��_B��%e��"������/������H�YM2~uE�nQ�]�9U��&d��� R>N�k)OH���J:� 2�����Ԑ?��g�`t�����=I�9T=�Q�y/sǠ8T��ÌN'0��8?%�,����h���I���Z����]?�>�O�,���Lqym�s�\�r+Ś7�G�~��q�<�u(���&ӧ���ٔl.��>T����{ ��U��Qy��x%����y�u>��9�<!�FS.��r��$J��F�X��]H^��З��@C{5H�����rk��P:a���ߗ��z��U}*ox�5�RBm��ɿnp�ܟ���tJ�:'"��ċ��i��S�[��L6�j{��#����e�F���F�b<������?���V�3����*S`�)��&0 ���j����3]�5ƌf]wl���=���_��DCX�Nִ�p���ލ�锧�:�U���C���G�̴��)�R"��%��[Y��P �Y}�`��(��@��i�X�x�%/�J}��d��^N��H�P%}K�Ѻ���}u�ܱ-ds~�q���F�����feq�{��7���F�6����a�'��ݖ4�f'<36id��o� |�$yv0|�!�|�(TH���\=���KwQ���{\y�ϝ�*�B�d��xyX��ڿU�Cs��`�,�{(�Ο�5�)n2Y�b5���^?��`���^�,v�Ҧ���f:f�K�w?�Ŗ6{6י��aM��>���({��:B�rhŘaY�y>��e� �P������{Ft���o���A7$`���S_oi�]�O��d��(�2���~Ō�.9�pC�=��o��Mn.�L�� ނ����6��s8
Behavioral task
behavioral1
Sample
deb47217f4f7bf32b2c94fbc8e5c1972b4f6223a480c62d0445d16506b902698.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
deb47217f4f7bf32b2c94fbc8e5c1972b4f6223a480c62d0445d16506b902698.exe
Resource
win10v2004-20220812-en
General
-
Target
deb47217f4f7bf32b2c94fbc8e5c1972b4f6223a480c62d0445d16506b902698
-
Size
416KB
-
MD5
82997bc23e30a36a85150b0892162695
-
SHA1
08bdafc698e54548ae27133a0cee5ebcf3335c3b
-
SHA256
deb47217f4f7bf32b2c94fbc8e5c1972b4f6223a480c62d0445d16506b902698
-
SHA512
b4940c2532c949e1c7695ce8114f6dc445532d97fc831036f0d836f8feb0fc21355a3dbbe758ac9f4b64105470d529f0943f682d18f6f45ab2cf63aef6e60059
-
SSDEEP
12288:N4GWY/AdxH4NYc+fa43OXyFxtTQctsRZaCJL3g:N4GWYodl4K1a43kBct0guk
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
deb47217f4f7bf32b2c94fbc8e5c1972b4f6223a480c62d0445d16506b902698.exe windows x86
c5c1794ff08f053c40c90c21ace7c559
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
sprintf
shlwapi
PathFileExistsA
kernel32
ExitProcess
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 814B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 347KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 400KB - Virtual size: 397KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ