�i*3q�����J�1r��/�F@���^wE���*����~wMK6b$ �8��C{w�ɦ�*�Ms*6���O�b%K鋋�Z6�O��kh�CΫ��� ���PFi��(��A�h���}�PemT�V������)o�v��R�H�<+�݉ kM}��tȷ�K�~Ֆ@�zaT0ϔ$ݓTh�c���=LP��78��*#�,c�/�ş���ѫ�M�\���,�.�Ic��,߮H��r.���Yr�d@<Q��_~"a�!�Rͥ�Z�t>[.�U���2�e���갆nG�f�is %���}Q�Tʚ ^�#%�@���RG_G؇5�$N:�l�%4G=�;)�j�O���X���2I�u�q�_���V\�%���%�9r(��b�T5���R��[�9�bv&1�[9��+7��6����������x�/]X��v�h����ĕ�7BS�M���@8�������(Ln�w�w���2�r�IS4��p�؋���_|厮��xɃ4��(��ӧ8�"x�ҹ�aĴ28"�"�d�\�o�d�AԂ�3?#�c��T���Պz~�0���58����#ъ��R3�zT�:Ӹ�TZ������Cl���Ywƃ�.PI֏>���9�7ɔk:ǂxH��0-�o�R4�BiEܲ]���x�4>�ȥO=0��L��اK��]�^�|��}������ �[���蓌�zԃ-7��c��Ƚ����)mx��a�!5��r)-�#���M�������E�9s��AK���:�"�|�r��e9G��6�����2�J�TT�|�y��KT��),�n������e�-J������˖�s�!�5�/İ�X�\gM9�@�j������dA5�h���w��[��F���u , �5�o͒X�xYi���*#�Kв�I����i֛�m3@�8���;�|�J�ǚ{VR����߷���|�fC{��g/]�+�\��ڑYF��-���d�#�D�wWo��;���6���=�و�B�XP��f�8� .�] �B��\�q�5���$΄�#^T\2� ������1��yYp����� {��FO,�µm2���7���LGP�#@�uf���o3����&WLk���p,v�s�@� ��v? �p��B���?��+��z�z ��8�����rZ��ف�vn������|�F�+���?4����;�= ����m�U�3�Ƶ9�4Y�Om"`���!,�Ə>�):�<vk�a��q�O��=�J��8�c�Ḉ�|S]M)F���6>��$a#�}Z_S����&��u�4jLw�.�]�b֙������Gմ�wV�y$,Swl��Z�8�ՆSKI�艛i�)�����P��`�}��Y�~Q�H�I���~��*���fSh���T��g���'�0�#_@Q�O�).�U~�hcb�ɗ���Hrr��>�a��u������U�3!�F�gj���/a�Y���0}ȾC��5/lN,O��*�H/WA��S���/U�S*��&��c�nAF�K�� ���z�ʌ˾vL���� hӅ����]{�9���oB� ���8�� :�fT�Ƽn1˻x�������`'�!fBk����[ �������26�u��c��oΒ��l�6�cD���rBk�꓁����_w۾�_�KVx����n~��rNl6��`d��S�p���h�:���e j��*`�HӓL�5۳� 1T�6= ������:p�[Ae�����Z �����^�"9b�H�� v${�X-�#h?�S㣛K�4Ư�?���ˇ�̜'o�� {�/-d:��e��k���7s���p��Q���0<$$�H+P>"��I���F�c�o\;e�����?�R.��o����Let� ��3���m�UZ���J��H��2!s�%'��ݗ�TM{�{���Q�؝�][�E����$�2t�Lf4��\�{�&"�ci���.ƪ�C�����3��_tӐq��}L���m O0Y}E'��b�@���K5�>(K:/�u�<���&/�~@N�!E����V?��y����.�`����E��]� �Rl�����\�� ����z���A�R���.[��$��*:�)��1G�Z�Oh%�3:�ۂ�)B��V�G�?�I ,�C�b�����#2�}�����0L?_�<� NՌ�zU��� ��"sN��ْ�a�_��G��}�FߔZ���; Ń4s4�4" ���>0��HM���R䎱��G�h'��0�*�Dl�]��& ��g�g�JN@��>�c;Ҵ�kJ����}�f����C�Y�3'�1��qI�M���=`�@��+o�;������Y-H�D �4����X<{��R�t&�����m����F���5i��te�}o&n�)s+Ӝn�Eĭ�[�-�DRɵ4*�P&+�ʛ$B}��w=n��4�H��uAr'��\��m"W� �0X6�d� �C7ˋ�n�0b�A���g��]�^��\�i{x�J���� ��|�tF����~pVi�f�[�'����i!X�Z�]h��.�3쇑6Gÿ��6��T���X)�+^|�G.����WeR�r�l�)�b�������T^k���ld��oh� ��|���ا~�HZ�-8Q��l��ɍ�F����!~����Yڑ�沌��h�g���l���l}��g2�����ή(HcL��`(��Kb�`�����������HU��*�,��.��b�+��5�J��Q���X-,���y�"w:ō�V�&$ ���\�D�9���7%�ĵ�e��'�e�b(��~��MӪq�� l<������d�lL-�~�]�����Q5LCbM2i�����&��I��OI�r`�Yp�K~A}��f����d*�jo��*�}C�~Fh^�~d�s���?�m��x��>�j^��09���4��Y�M|��-.��5���D��Z��֑�(��A Pg�Z!���J� :���[,Wjy���f���KwCg^ ��F���G����\ݑ�eO�?��W�� I"b��,͓���0E��l
Behavioral task
behavioral1
Sample
9e0710a5c5b3cb20cea7fcd1ec29a611a99b8000f3cae2f1aaa7c3aa5bdcec3e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9e0710a5c5b3cb20cea7fcd1ec29a611a99b8000f3cae2f1aaa7c3aa5bdcec3e.exe
Resource
win10v2004-20221111-en
General
-
Target
9e0710a5c5b3cb20cea7fcd1ec29a611a99b8000f3cae2f1aaa7c3aa5bdcec3e
-
Size
716KB
-
MD5
807f2d3f1c6147329be1991d62ae37a5
-
SHA1
df08f442147a64b46ba6323fa7083e9171a538a5
-
SHA256
9e0710a5c5b3cb20cea7fcd1ec29a611a99b8000f3cae2f1aaa7c3aa5bdcec3e
-
SHA512
861b847179ad6cad855c479e2bcadf7bc5663555b1436cad63680c3df062a089205ebefc60f67a48867d886980e7f60ec93597c7df8ec4e6d2765d51efd53ff9
-
SSDEEP
12288:DGYbl/dQ83xcLjVg0+RKwQQg8wWgUF2aEE5574ZklTwuBwMmWhPzA:DGYo83xcLmZ5QT8wWFF2aEY74GXmWrA
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
9e0710a5c5b3cb20cea7fcd1ec29a611a99b8000f3cae2f1aaa7c3aa5bdcec3e.exe windows x86
bf87d01af04e5a4293f0e6a58986f206
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord595
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 668KB - Virtual size: 667KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE