(�`X�f�]��.�!:�S�w>%�m>�ѡҚQ�Ǡo��5U�:pL����%�2O����̍He�7����h^F�l�~��H��P��(5�6�8H\���:���M���n54��N�x<aӱB����qY���Sb�¶8�n72@��T Jj�H,*ѫx��R�W&��(�H��z�����$�&���&�Y]9�oa����xn�_bR��&���p�� O����.Y=�B�f����>ֺ,E,���,=Q�� l���y�n��ő2bi�$F�}s�z������6h�3��g�+qI{�2�d�� E���C>�:y28�lB{������^ʨ*�b�L���xT+� ��~B��A��(D�xaޠ+>y�MH�l}��$�mʣ��ayO�q���� �lO���5�r�BK� �%U�}�K���F8��a a�,���~OE_~��و2���*��Eݏ��:�bgsssW�$ŵ����z��.4�j�W� /Q <x���ڻ]�baR��ّ��'�+���@`�0i�G0���Ǔ���Ǔ�һ!ˋ�������F�c;����"z� ~A�`v�doo�g���o߹DT��|�!� [Z0� ��Y�qAn���_���KU-yt}Dz��:)��Z,T�(�. ��N;=�6�Dg�Ǘ�=����f_�e2ơܖWg�,*�� ��%��q ""����e\�Ȩ�6[LJc�XB_� $�LC��[��C����aon���RvK([���</��� ����Htk��(�y����竞6L�¦w>QShջ��y%�F��s��"���v�/;6��;&2Ey�MHўo4�����^9f��-��y�C��<�����O���e���CeL�<��f�����g���xA�$�P���D~����W�Bq��f�kMG���D�G���5�Ů+dޝ�f� ����~���fפ%g�ܕ�?Ҧ�ٳʹ.���\�S�+�I��:��SvKv2_�B����@�"F{Æ�g�R�`��$p�24 �n�k �Is8���=�0�+rj��2������cw3�)�LB{��1(O��HV���j�2�}��8��L/��fd���B�O_麢�F=2����y�J�\�?�ߔv%��X�!���P��d��C�p�z0���x-o _��)��DL�i^]4������C�G5����*d9�F�=���a���o e��]��`Q��&OGd�e�n�I�}�bo��y�����|Z�V�8��?U�~5�������a3l��e����J��k��%��$|�Bt�����=Ōi�-��w�7Q��=��.� C}F���b���m^P1��6!0�n��lȭ��'���Z��"��s���'�_'�Ȁ�������e$�[p\=ڼ¬v��͑������N��~z )<禎�a�n϶���Ѿ�_�EXn\��(��즗��.,���������;;-��h�{7�A�u��9ke��K8Z��jwVm��w�&Sod�� ��� .��F��#�hX��[��n����)߆>�G&"��Cx�}�̉�}�QY V�P��͙0G�� d��*V$Ù%�-+5�1��јj��i�(i]'D���Mݸ3CQ�9��}j�@띪\HB&��Ygs�dX�Y�������,�ar&Q�>�J��:B�%��i#���'HE�*�$z�I�ZXQ��h�<Ϥ��g�E���boܮ���3qē�'��=�lXF}�B7�I��>c��ܧ���b��R����bk��4��?u���PT�5�B���Wk�A��yqTS�N�D"��������v���/C������7�*�Pψ\�5²��!p2F˔U5��m�/�t͵N����{��'�Y:ͻ�˦�i�l��a�K���L���43�@��%6��]��xT���TfA��K��-Q��p�D�_���>|�l%������?�l�|LJc�C�(��J^N������K-����Sv�H%�j��V�vھ�(2���q�G�|��r��hcHp"M+xV1/��˵��v_���&� ��������>{��xO`{ .���?E����&�E{��m7�Bb��ޢ��K��u��0�r���4h"�/F0���C�r�R@�r����3&6��r����rX`s����(7���~7wa6e���ʯ��8C t�禋/To�(�c��u��-�+�������f �x!��9��`Ҝ-9��/ py�*#�,$�pԿQl)�!8������1n$i�`jsU�[ ~ۉ�\ �kc�b�|J�FBba��\Z~��� ����~��]���ar6�H��g�nK̄����IGH҂=��T����]�T}��M�N�� �JCW~� N�]���j�&�b��18�}r�GMr��(�<2(���Գ):���Zb��f'a}[��!��rIkj�0���,�� �!H����3�;D��,�������z�� 0ď1�, ��Ů�z�Ӿ4%�����ndJ��A>��W�1��{}ED����ʫ%��hɽg�+]��,�SVo�3�� ���H��e���:+������rn�ԬS��g��q�$m� mÈ�4wd�lhV�*r��`�<�L��Q�6�J�d��SY7�C�7�b�V̢#m���Y��UXq#�����b�"3�>�.�Q��ʇ�'"oA��=���@W9�-]�0��D����TV^�Un�kiҋ��~q��(�g;2���q��U&���Z���I���Ni<��̦�YZ�i`��q*���QU�)-��U}�`�R�B�=϶L�]>��˚�Y��m��*�R�0]p�đ��nE�7(~ �oH��x;>�}���� !(����{7C4^�>-�^1��YB�wV���t}#�����E�8���=��x��f �������(�|Q8�f�IZ|�hVr�s��N<1����!��c�q]�>��$_\UZ����Z�D{�$ ������w��q/`��3saBUm�4;#��Q3�y��S �)%�y%�"�p��ˌ�ۨ���1��?�uG�~�)t$_��<j^kD~��d:��Fˮ%~���&�!�h�!h
Behavioral task
behavioral1
Sample
227d1a768be2e4158e7c1d68715941addaccafd5ea4123bfcda62b68eccad819.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
227d1a768be2e4158e7c1d68715941addaccafd5ea4123bfcda62b68eccad819.exe
Resource
win10v2004-20230221-en
General
-
Target
227d1a768be2e4158e7c1d68715941addaccafd5ea4123bfcda62b68eccad819
-
Size
5.0MB
-
MD5
9dfa242b6cce0eaaa1201741f5d60d37
-
SHA1
08bb266c655bed1ec4912f3ad6da53b7ecdf2dee
-
SHA256
227d1a768be2e4158e7c1d68715941addaccafd5ea4123bfcda62b68eccad819
-
SHA512
dca69fa6251b88f3b2c888ca6abffb4b99fa889c234418347b2b15ab2ae50c3e09f0e9fc43881ed97c1b8d064622b592c126e0d2ed989545202dcd4bd96e2f5c
-
SSDEEP
98304:UJF9/ze/4OGIGkQn4wve6cWqBo0un4V+xOicqQQOCzRRIY5fr:m3/7OGhkJ6ex0GWjiQOgRV
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 227d1a768be2e4158e7c1d68715941addaccafd5ea4123bfcda62b68eccad819
Files
-
227d1a768be2e4158e7c1d68715941addaccafd5ea4123bfcda62b68eccad819.exe windows x86
ee661c5297571b43c9ecc508c999f968
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutReset
ws2_32
closesocket
kernel32
GetVersionExA
GetVersion
ExitProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
gdi32
SetWindowExtEx
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
LHashValOfNameSys
comctl32
ImageList_Read
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 611KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 925KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ