�-]#�ogJ҈d�x?�'������C[ò����Gjh�LH��:�p�nKv�5�&%c?_rtS�@+����gCX�����.jw��/����Pߺ���l�������zg\*F��4&Xr!�A�������q�J�jq[8Y�m=�*jmvZD�Uq@���Ec�x�fĕ���,�!���Vn��ޗ��W˝p汍k�9䈟N�B*37�ë�ېK� k��4���)�AY(7�l`�nn��7��a�9��\���g��y��~h�e�ބ1�/ ��d�v�I!�s��?x���<�^�#*���U��>�1hd@P���������AI�?�6Ȳ8��W�/����ʸ\z"3�QIzd���=Rݡ�Wh�h�3u���ߧJ"���A��9Jį�Ħ�/Vp/�����XsE;�����jr݀��]�>�DӌMJ�I�� ��:B��)ɿPx��jb0����{��v=��Zl@�B6'���:�R♲8@�y\�sT���x뇁�E�I]��.Ӻ��+B�BV�ʋ�|u42��f���a�-*&�T�KI��ct�xɌJ�ƴ����4���^\�ݢ�ی�����nV=.{�f�W� �0}�N���QZ; 8��Vхق�e]�u^<�q��l#v���c(x%�N�Hc�Ȫ�=���:@�f8�����YB���[@R�k��0���9��L�1��j(� ����k�WZ{��������+=a^=V�E��f�_iN���8��|�h���ټd$��8��(� �f��n�6�3O��ߜ-���1��j~��� ��}�3���Q�j�a��o�d-Wa�O������/�]��g�H����"�H�9H���娘or��>�;�22�R��'%ApXi+��~C7/6�4��O�5�}��6 őy|�t��|l4�0�WJ��~Ҡ�nb:��'=�7��[s�O�t�$��)*2��0Hp��/� �8�N-C��_p-O�B�!���*L������V0 ����`�JJ�������@���_� �8�Gj�3���RR����X��V��*�֠�����\������ހ��AZצ�,����P<���XD!�s��ŕ�Yɮ�(�z��7Q�� �G*|#&��cUڏn ]�Yi�&�ho�P1g�c8�J�i�<���K�����v��y���u2Y�Zw���[�`P�+9�_�1P� ���ى�f��B�c�!2"fh$�1?�U���Z�~���b�e��j"����0!����,�CTG�s1� �@�7�8Ѱ�]ݔU[�F t�IJq�2���7��Y��I&� ������qN<��w ��a��[��Mrn=�%��T f�Fh����d�VX��-���su��<�@���'4�<1 �KeD��� /q��p��l+[F��\I�@��ܢ<�/k�*߸~s��3Ğ*k!)9C�����Q �OFLE���-� P��O���T��Bs��>��>��DU7�e�ݡkڇ�;'ɦ!����ѥ���/�_!\���ۻzzUq��x\9�:�-�[3Sq ��:%��nM"�7��D�����$?�' �Po����gkH���r��1e ��$̂JC6���[�����ѭ;,66���ٛY:��b#�l�E�0m���4&(CP�RHd$Ջ� ��%��)���z~�`J�)��+��qM��r:������`�ޓ�az��⼯0+�zZ҃�%P!��Ҍ�z �4����!WC_���n�.pJ9�����M����(���0h���2�_l�N<������'�`n˰P����+\������;v���6x�q��G��-�+�bա��qQ�?}�YT���j?٧ҵj����76�+��w��2 �Jkw��H���ؿ:�C;1uHؠ�%� L ��'\������������!B�<���CI�4���d�(�`�LQ����@*Ӫ���nqۍվ9;�_�6���ǭE�����:G�F�����v��� ����t�%Z�M3_֮��d�\q��Q�� =� ���k�3wМX���ߘ��a�gW������Sl�ƽ�@^��t';��˻����/�a�q� V�B�N�=&G��n�H���u6��kLK�9�S���(o�7��W�5��)��hp�c�4��=7�_�n#�1�A�{!���6 ճ���]�ġ��a90�a0Saf���eZM��|į�Ύw��~!�N�-��r��em���� XB�|�{���X��uJ0&=���W%)<���l����T�i��,X��t����U����/�x�� ��C�k:�s8Pc'���V�V{l�p����� U��������@'bB��=����X����*�����Ů�� %"ެ����e�3!nm �<Q�^�ư/b���VB��� C��9wU�3p�e�-$2{�_��Q3AG�{3)K��j��d�p{*f�^ư�?a#�ѱ%�QG�������!E�l`z�D�t n�<���+ܩшQ��[�q�K1��l��1�V����-<�����MRkȦ�H Of�ߑ�U՛,��z�O�Zۆ� ��?x��A��g�O�"���5X�zW<oa`��K�n�m����AȮfH>��j���k�yil�B�4ʤ�Q��?���� a��B��)nI�F����هv�:��_��Vf<��2}O ��i���e���+|:=���~�k�8ֵ��Mߐ}c ��i�D_[#�g�v1Y$Ky[���|ۍ�l�#|��u#���J;���T�&���/ n!����s�����=�1�'����!�迕b]�2K(�������d,Y��%�| 8*Z�ң�UE��R��Z��6��G�+ul��X`zN�<�$=Tr�P%��a�,š#<�:4��F�9x��U2ԭ�|Ϡ`&���H?!(OIɞӠ!�<��`���D�p|~%�Ȼ�[ V ��!,?�ܽ�����D�� _�t��y����;wB���~�Q��3�C���3Y�>�3ͫ�B2F��jYӁ�������=1(�ºÆ�z�����Y;<�!�<��Rx2Qd8��]P֬l�
Behavioral task
behavioral1
Sample
a9cc505e7f4db223a753f8548143d6208fc5b8a47298db575c9b3d95bb23454a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a9cc505e7f4db223a753f8548143d6208fc5b8a47298db575c9b3d95bb23454a.exe
Resource
win10v2004-20220812-en
General
-
Target
a9cc505e7f4db223a753f8548143d6208fc5b8a47298db575c9b3d95bb23454a
-
Size
724KB
-
MD5
e5a80011e324542dd072b69caac3d14b
-
SHA1
0709d573e1d6dbae48b028a386bb98098db50bd2
-
SHA256
a9cc505e7f4db223a753f8548143d6208fc5b8a47298db575c9b3d95bb23454a
-
SHA512
3d8ca930b71f6cadca2778af8286c98a7ef07e8397d13d566a41aad0462ad30bef6b2f59886db5725b69f3e8dec45c755c90d5796cd6035eda7274faba62440f
-
SSDEEP
12288:x1BKLeJGWeuVO5SdDQCKmlrtI0k7/kbAX8iJ0wVUVIE7nMnAoP:xtJGb7SNQChlrK0k7sbPiJ0wVUV77nXg
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
a9cc505e7f4db223a753f8548143d6208fc5b8a47298db575c9b3d95bb23454a.exe windows x86
1502892ff65cdf7a201cdebddc5a2061
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord670
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 646KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 712KB - Virtual size: 709KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE