� DG3⟍��Ck�~_C�֮�����y��B���=7�����{�)&��8����FŨ��۸s���I��6��m��JE���+��6R;о���l{(�.:fIT��%���S�����N��R�l)b�;��%]!Ø�>ƣf��T�X �3 ��6_ �y�=�l�~bzDO��|���>1|�����b�1y�� 纅�~@?z{�� ��u���(�`�.�H#�/����N�?�@6��ujbb�A��\&�z`��"�>��&f�:j�{F���'��)�>��dI�3c+eGZ�O�%��[lg}�PY�08��`H���1o��Y���;��)��.�D�$g}��X��� 纮T��� Nt)(�����4���Rq�y���ò��� M��Ӻ���ա�yz~2�|��z+�7A��Rl��"����� B?[e;K�M�XԚH��<'h_��:�K*��¥���u���dXr�0��y�wV���<_ͻt�Iu������C��N���W�\��I��Ѭ�����#FWq�fb=��Y;b�Ѿ��*f%@�I ��S U���0�%PJG0�eir�g#�5��ȝ}��f�`���]��¥ ��������x�8�`���T�5y/w9��r2̓��"X>N�B=l���;ߺ/NcZ���$%�%��a�'�d�7 g�I\T�sx���.X��.���&��K�,��c~���e ��Lz���km��&"߈�/-�ÇLT���;;�)o�5��\��9�Q|��� �)����O��솑�EW]֚�{�x��� ��Ow5�fg͕��mnn,�X��1����s�\��;�����}Q��=3r��]h�D��Ί$����1Oן��t��D$��9���(svc �Ns��������C���|��v�"MK��?�e�ڎL��2�镹e�Y����y���|_ļ���3>��9�k���m�5�6�.ս�*�.�)A���o�^�� "y����P;�'�"lI/u2K��]�L�?s�I��0;�V�E{��c>��_���L���䋬� �t�'�D:�ϖ�����F����j�Z-�r��|+,��-P��{��m>"?�g�@�OB0*k�ѯ����N�����DƠOW:���{��zve�W���N��,p�U����_�@u�8S�ۋ\vp�P��4-u��n�x�1�C}���RY��lհg4I��X�}�l����[�������a]H�b�c��h?�ۺY����+7��Q�OQF<����èb����W�[_ "�8�&K����\#���i��Cm���7R�6��a����ޔԦ�0�L�1�������h�]�["��$���_�2�?O9g�?�m�¨[�[�A \���{�ۥ�����eś�b���в~����l@c�� �_�,Z�:��(�V���9�j�r��a���w.��ci�N�T-:��ޫ�7���� 2�vn����h��*-�?P$pn�0�&|���JrR8�}�B�K�v;�!��O���W0�ז3�� @1�.,L��y���QR,��8Y�+�[�b�sw$Xu����$ ��f��b�?x1".�d���]��Eu�@vpO����Y���C�7T��`����K� |�0�P3�c��u���D0�� ��`(+�k^u�ImO��Vq�x����i9�A:K����Ϙ��LZ��}��� &HF}��"�PA�Ų�s �����h�yԟ硔��1٭Ĥ�u�0�Pƚ\_Imy�A<�X�ff�f{�A��㙉4�b�<�ɺJ�,��8��ד��Y��ţ-��7�T���UY�<Ҥ���+3� � �D=�se��~�&$�]��ѳTw��B���0�iA^�o��?�� ����IkT�u� ��k"�MJ&D[n�[�����u�+)�&�l��]/E��N�G|V?�Cb�'�f�R�y��H�� if4���w��������ہ����.���d�꾇e���& ko�c�EG]��eM����eM� ����r:��#��q`�w�f����` !y��܂`�g9��5K����r��W�y�7���>p����8�+yr7<����w��K1�Q�j����M�h�r�\��W��-L�9z+T���m�����i�^�j�g2���5�W^4�O�?��'���>%hU�vs�a��_l��hX�t�0�n����;m9P� D�3�lJ�X��K*��TN R\Rs��!K\�Ȫ��W�����i&zz�7��$n�#9��Q<-� �~��A yβ #�bP#�-�Tl�₶)�����JG{�Z�~���8�ٰ�2��yN� 1/�^�-��M����U���Ն|UՓt/�t�f�(�= ���2e"��D��������W��ሠ���7N;O������,hG}�(�А��քdC��ܒyd;��l�zk��&�7�YB���njm��\c�\N~=��+��z����~S(p�4�y���D��K5��'Tϝ���a�;(�[Y���`�h��,�R�V���CYsMi�1,��fރL�et�Гz�����v`>³Y��X&�QP�-��.h娚�a�-��Z���:��^�`���-ox1��-��3r�{ ���^D���Pֲ�G@�!����o�A5G�Xq+�Fj�^3�i�����g���� ؋� ��i��JJ|���栴Z��gc 1F����W.k�>:}S#��q[z��{�@mt�f_`uۧ"��>S��`֫��}+Wgr �M�y�0fǩB��[%50*k�w�2��>{J' >�8�Z���L�_4�����~���$hx{�5��V���z�yM���Pgf��6!d�7DZC�Tmqe3�-��Z����:�d8�8�/d,��@�ؼ�����mu�OGe��~3/$Nv�oޒ��7����A�}TrZ�^����P���?��G,ګ���_9�� ��K���Y����q��OS�[��ZG��)�JٜK���Inꪺ�aĨ$�����F�o��ZJ�� .`��Xl��M��6��_�S����q���ޠ<�wp,[����6<�|@�T�ܚ��a�pW��M�
Behavioral task
behavioral1
Sample
bf645903d93f21527a69ec25690487f21a478c1e17007ae22e7fc67fd1ebab00.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bf645903d93f21527a69ec25690487f21a478c1e17007ae22e7fc67fd1ebab00.exe
Resource
win10v2004-20221111-en
General
-
Target
bf645903d93f21527a69ec25690487f21a478c1e17007ae22e7fc67fd1ebab00
-
Size
260KB
-
MD5
c2fceabfa82587f195768c3c783a1bf8
-
SHA1
9cbf0261ce66fcb02f1fc719a0915007333b9f7f
-
SHA256
bf645903d93f21527a69ec25690487f21a478c1e17007ae22e7fc67fd1ebab00
-
SHA512
132702463c92f951a7e7249f550a3cae2b71d59423d9e94d1b377a95eed526e29d4a23a81e1cba0ee3aeeb89ad88e38b4fadac20707ede2c09dfb1ae350dbd69
-
SSDEEP
6144:vOCnEwtfD9eHr5KlBjHgrnoyL0xxX7qMaIHp:WCWLEpHIo6m7qMaIH
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
bf645903d93f21527a69ec25690487f21a478c1e17007ae22e7fc67fd1ebab00.exe windows x86
7cf368dedb4d8e3aa600f2a60a9ff9d5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
ExitProcess
CloseHandle
WriteFile
CreateFileA
WaitForSingleObject
CreateProcessA
GetStartupInfoA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
wsprintfA
MessageBoxA
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 816B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 338B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 248KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ