UC�Hq���� W�����5����~���EҪ�P����oJ�*W���U&�_���]��h�X����g؋R"7uA��D%�u<v#�(�K�oоŊ${�#��gfnKvZ�)]@l�_Rl�`a}'�$/X(�ɸ�1��$���S�N�6�AN�\�m�(��s�ܙ~��m����",��[\��D�y�xTE�W�hZ���L�#ܞ�U��0Cӓ&j)^@W�D�r�g4��R����0�l��h�d�Xc�ج��)gխ>. �c��G��k��3����ʲ����#f�t�{gB�?�a��~�W | .�&}* �v(��f�/����S�MX�x�~��qgc ;�T�+l�(�Z����C�.:�R+�#<8�z��M����r�����Z�AT(���`E���u�N� LSkH��7,���9�r�\U,�Z�͚�h��{s�2?�+���|������g<�>0 1<L)��C�@<-a����A��v��<�a�Ŧ]��������?�Cu:)B�;~#F><�����XC(�燐R˫Pɞ�d-��t�4<��4�Ɵ������YU��a"� �����g� AUĆS��b�����LEGy�8��dH�~k2&��XV�u���U��8ڛ:|[��c �PP8*��KyD�kB9��Y����<�_�dR�l7e�WF|�Q:���t>��V|�K�yD�>9��2��F�P��Us�U��EB͕�n،��l�*�'� ,���ϡO�� g`fm�-���Qud0L\M�%-áټ�y:z�D������wҥ$��.������ L_�I�#���%c{��T���1~ �,�hQ��gS-Y�'���A=/����̭H�S�����CTr0��S����T�����~��@ϫ�%�˜�V�Mkg¡�xE��C�s8]�'���6k�/|�!���fDmf1���L�+;c�A�����;�ՙ��̸�Q��O�C:ui��AJ2),���}�E2�8$ ���R@=VQ�%�]��h��ՉR�֡Q�3?��5��K�G���mAL�l��\_��TM�4o��'2�/�^�EH�t�L�����+�B{�$����CE����͆s��ī�x���N���Z7�������Gg���x���".����C�ʳ�_����:��j�2)����QAa�Ѓ�r�� �4«Sʏ3����v(:��� �F��5/,㴿O�������[��wQ<��)�$��V+� �(|� �\|�D��� �ݽQ��I����E/t�)O�;a$o����C�OuQ�,d��u_����Bl���������bA�jR0�lOFw;�^�,V��(��U���P~�2��� ��?��߳=���ȣ%�����:[}(8�N"�d��S�DH'}.�2Q,��1)���+㺂�+�2-"�eDA�˛#�~܉����Y��ѷz�҄2c�@�;�� "�B�[�0�J�T^?0�Ɔ��:3,�V��!Ki���d ��Y@����6?����%G�/C�z5�B����̳G�D6�պೇ�H�������:�i��Cơ}}ᚆrƿm���7`)z�d��o�$��ax�@�<Bc2�F;'#�ܬ@�v���q���]x����3��d�O��z��\5e�;L���x䯴�K19T#��U*t��ϑ���"�æ�5N�ȊƯ�A��r�H��,�H�l���Q�&�n[�>B�Tbr��Rs�N-�B�������I�b�MLrSL� e�7��BY�����r�oO��)�"�CG��g$����I����,Q]��oE����զ��_�E�~��j�!߿`���A/¾۞3GL�� ����0��q9vУRb�X��'�4Pq+4�X�(w�_����ܼ�-�1Tŭ�8#�9)�Wa���P�Z��8#/\���9W��%�Y�p���8�q��� 2pe{f��1�v���;g{��;̕��X��a� &<��;�o ���"W������Bb��Bj��U��q\b�2�giӯ��ط#�Mh�jO����XL��5��a��Ί���_��L'�뗋���R�\��$o��:Nqti��/#a�e�y��}+N��dR���,߅�K<�������>9Hc��J�$ O3�wc�bʁi�b]"F1�g�����W�4�3���O� |��UR7z�\��)A�:$F��W�r���s�C���ߝ;B�:U���7@7۞��uU���������VEK������B�R�Z��d�[+BS!�p��`&~Z��V!�� �vbR�A'�FJ߱�Q?(�)���0i�w���E�ߪ�l���.��QF/o�xBN��}�>�D< �����y���PkX�&u|�ߟ ���9�h���z ��7�����`�����k�{ny��TJ����TESFD�ӕ�e�F�q[8���`_�P O�r���A�<b�q�-�/����g0��,�Z���o4�R��߂R##�w�Gǔ���q(��{���y`n{���-lt�=�&�#c zL�,���/�#mJ�I���BQLpv�ߦaX�E��I,G�;$W��CR|n�O�g�^�$���i�'�D7u$��rF���^^ao�g���3����=���W�wTeM���a\|�փ�����؆5?�AC���``A�W��L�����x��].U�ֲ���y�>ӗ*?�������A��hd�ga�ڰ�Z7RpM��e�[%^�z��7������#g#�> �14� ����7�P�ꏈ�A45{�4F�����8�TF� �"��D�I|ҝ`�U�Z�g�[8R��O/ަo�8�ui�)��,|{����Y/M������.ip�@N��q��/��-|�q���X\3�z%DZ�~��{��fk�hSrl�co�'>G�@���4�*8Y�[�V��*E�#� 7;�,�G��L*�~L�Mm8�u���-��� I2�P�Ψ'�Yrˮ9�TTʐn�����IH(��q3������i�㗈H���U���X�T��01 ��c�������`1��Xo�H��M����:�'���7��/�nd>��bt6j}��y��,�Xٗ���Da,!ߠ�y �Ȣ
Behavioral task
behavioral1
Sample
0fdb31ac13ac5eb89e02b1aa478aa848b4bc583e9a798a5bf30aaf3539a70936.exe
Resource
win7-20230220-en
General
-
Target
0fdb31ac13ac5eb89e02b1aa478aa848b4bc583e9a798a5bf30aaf3539a70936
-
Size
5.8MB
-
MD5
5bed20b571f359147f8553c74e2cecbd
-
SHA1
a67bbd5e911cd16dbc3f8eec33630d6fa72a5a44
-
SHA256
0fdb31ac13ac5eb89e02b1aa478aa848b4bc583e9a798a5bf30aaf3539a70936
-
SHA512
9b9ebd000d5e95752461808aebafad4ee2ff297a90dd6c9cafcf1ab67b945668c973409f940aa95c3b1b19adfb6d4d14b1681c4eeb9bd105c39c1aab818e2adf
-
SSDEEP
98304:qbmW0cqxmgDJyk9hNY87SmvuQ8SHx/DKgQkDys9TvrB8RyFH4PCGLlEgpUhXArLr:CmVcqDJB9hNBSmWQ8W/DgkOs9TzeRoHq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fdb31ac13ac5eb89e02b1aa478aa848b4bc583e9a798a5bf30aaf3539a70936
Files
-
0fdb31ac13ac5eb89e02b1aa478aa848b4bc583e9a798a5bf30aaf3539a70936.exe windows x86
f42acb594d4114162ba934da155a6cd1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutClose
ws2_32
ntohl
rasapi32
RasHangUpA
kernel32
TerminateProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CopyAcceleratorTableA
gdi32
OffsetViewportOrgEx
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
SHEmptyRecycleBinA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
wininet
DeleteUrlCacheEntry
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 921KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 474KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ