���4�x�k���t�R��]�@�<�{k��TS"b)B$����9�� /�*�~������0�)��B��{u�v����[5)�+�ǹ����;y_�"W�{��4�w�{��跏~�@]��P���I��ֶ_�O������c�Ʈ��B�u�(вå��v��T���� ���c�{�Ga3bW�øO��Z���N�%�N�� ^�+�@�V~���;��x�Z/�w(�q� ClWu`cQX�az�O鴏�7(�>o����$��6^����4�k�ʃ�t�U����'��V�9c%E�Q�A��Yu��Lf}29�����"Ux��*�g�&�r�a4�O��z�芖��萃]<�ȉ���:�/�m�0�d�4F�Qmg�����?����}h1"!iX�aP��rl/{^�����u���6����*5��zՂ_���\�:��&�|���=�V��Q/�G������o�atrGĸf��~��ں.�F ku��_A>s���ёNo��4 Q+�P42W�Or�gZ����a1ۙ2}����+�B�c��u��&����s�G�se�/L�"D��bud�~6���D�>9�0�?/�����`��*(�A9"��#3�X��Q^�FL�!��B`�Y���ڝ߱-��S�*h����M�Q��0fkq���������)�w�qb����t~� e�ѽ�Ţ����Q)$j]AoFa���-,�o�V�q��"g;]�kR�E��jhx��P��KQ�7�s�4�]`��eU.h�A<���x��ā3��EN��pC �v��%���*7>���e�K��r�GhY�S�˄wn��O�,�P�f����H&lw/�ér}߅P��罼���B~��.����-�0��|��y���X�;ױ �1G�5���^�2�T �Qs] g�&��Rv��Qo9]��hB>��P_o� ��Wì�t���@|uV��(>��䕇�� ���T<��� ��������S���3]��h��]�[�F&*��nQ���E�����������;�=�W��I�hQC�]�G��ݑ�08�*�I'��J~�]qc ;�ɾ�e4�p��?d��TFۀEPF���O���&��2B+��I�a'Wύm��>/`���fL٨�t5�3��KE����m���Q����c��vy��D�i5�pPo�k�u�1�_���W�\�#:uWae������uu�z �m���F(�.:���)hO�[&�=����ns� h�����!&&�K�V�ԉ�����^����I�w�˗��YLL�g���#D�2�w`tx��{���t�"�Y���m`��/�l�r�3�d�T��z'kt F>��e�&��GE)����������% ���ړO/y/��`���A1JY�tMc���u ]�9;������'b.M��Tҋ4P���aܴ9w&b+5u�!��� J�6�� H��Iai���ҩY���j�>[�X�n��Ld��1,Ӥ,gL����ScZ��A�1�����[��z����I>Iz���K���iG�s�hr�g������-/�3z�s��C�H&����I�������Ow*&��c�mo����8�?p�C�A>����)����E�����4@�R���˨����h�Su$�<n��+VL]��N�����goj ��1or 1�6��K+ ��\��""Xc^l���3��A}�����_ٸ5<�K���_ ��t�� A�����E?��+�F���~y���Pc�$]�\Ya���Ok՞:v;�ׂ�UdH9��tx���\5���O<�A��!�`� 1:� �?��6a��q/#�)w~q�qd��\�+�0�R��玾r���ӹ:�H�V�=��h#'��<?��v��c[�#�t���!�]i��T���X�(6�P)KS�z�EɌaP��vH�Z�Ici����悴UqX�uD���e�}��V��~�^�l�#��?�kgK�RچD��;�$1[2�C(e��i�C��ф�k|�������A���P�����E���(�� c�%Ÿ���~W>�Sso���7�X���2� d��=f����z-�j��R$[�����-�B���۰��C>�Rʋ���?>�S�?���0]�/r�|�E�A���$NĹ]7���\ZZ�j�� &����p\�����T��6Ǭ*6m���!�q�Ot��佤���w�b]����9��|nܻ�5{O�;�h��R�<�� -�Yn�5؛M�XUOళTR!�!|ƹֿj����m�C�����=���qt{����WJ��˻�=���X��V�,#�8�}4DZ*��@&����qrE�`���M� G$���Q�-/5+z �~� s�#�)W��-FYAS _�Q��J��eԔ�V :��$�Յ$FA qD�T�4����ǹ[N��YV��=F�Z��y�ɳ�a�an��2��,+�`�V�4�.��ֆ�av���G��������̜��}v��8SSv��!���MS�7����+#ܐ�`������Ѫ�VۧJ�\JVX�� �K��x���mw�|S�h��2�����$�(jg~;!y!�ۍ ����۱��AI��5&�C��+�a�� ��s.�6��7���fWku�{@��g:,���*�.7�n��64��[�x NpT�����3�PLvB��u&T�T8CW0�7,t=�_��2�z_����t������[�8^n���r؝�~�;�pɓ���_|{�=ۏN�8��RQ;��u}� Ǟ�Pұ���(Hnzd��#����^�{��Ԕ�v�(W��X��nl�9�t̄.��~��Tq�>'�����Hb�n��%�5"� ��>U�5���=*)��GTVjb���ny�D�����֯��B��=�̖fJ8�h����e�P;.y�?����̐�{9���0�E��75%��P-�F� ,,n4R��n��� �3��rX<:r7kf4�0�Z���*`����,��Щ��1����^ =���h�����ԽmZ�-�n�:�^�[S��O�WG0
Behavioral task
behavioral1
Sample
aff8164f56c8d02654161f1cdb2e8a81a708670dd2538b3cbeabffd398a96085.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
aff8164f56c8d02654161f1cdb2e8a81a708670dd2538b3cbeabffd398a96085.exe
Resource
win10v2004-20221111-en
General
-
Target
aff8164f56c8d02654161f1cdb2e8a81a708670dd2538b3cbeabffd398a96085
-
Size
256KB
-
MD5
051f3ed2ab31b880ab910af5eb77cec6
-
SHA1
1bb16efeec2edd345f281eec9aae990af25f630a
-
SHA256
aff8164f56c8d02654161f1cdb2e8a81a708670dd2538b3cbeabffd398a96085
-
SHA512
15d6a6f975b092755d0cbe4fa0ee92968b68b347efde25fdcc8f30ab4989563fc7afb7850da810ff34da4c385e658f79b47a74086e0fa25bb3ff27afc27974fb
-
SSDEEP
3072:xqBW+LlJpDvnlhmihQb18i7JvJDvQEYBkKbGvNQRgpZ7g7Rau/xqu:xx+BJxnlhmihFovaR2IGvNagpZ7gN95
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
aff8164f56c8d02654161f1cdb2e8a81a708670dd2538b3cbeabffd398a96085.exe windows x86
d24669cc89e054bf8e58f33ab2990870
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
__getmainargs
comctl32
InitCommonControlsEx
msvcp60
?fail@ios_base@std@@QBE_NXZ
Exports
Exports
Sections
.text Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc0 Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ