��v�u<����j��K��<u�±m���e��� �ʉ'gOݗ��o���wѸ�=�\����tt��`*YҒ�ϛ����`���@����nN,£K�$�=���;'���V=Y��'���*�nl�o��i�Q����|��0�_W�SŜ ~�m�y�.����'6�p#g�]�*^Ym��G�_&�X�K>��J��X�8{�(\������?�X�Y[��(���D�SG�V�:nFB���+�Sg�{��9�)�ϳp�q�J����a��b\ˮ w�F��h�W�ɲjh?A�W�2�F����馺�[��j�/虃�F�����F�G,��za�F�mѮ^t#ڣ<��@3O������g P��°�R�&W��`�u9�b}�� o�Cg��߭=a,H ���=�����+�Ab���(���nM���Fn&�}��Q���@��4��ǒE�-S�*��@?#z2p��;F�Y2#�a��}���.x����d0e���«��*��V�m)�|���I ����w��H ���N�����ݿ���4GUP� @� ����>Ab#Y� ��c�;�X�������=98����x&��*ͦ7ٻ�����I� ��2���Ij1��U��S�2����h$I ��q��AfӴ���| H��d���oP/�~Dᇹ��T���'D��*�w��RYߪR0�����i��l��������a����������'�]h8x�}�v �&U����v$i���l��j�JR��'�XC��`b����6��.�#ʂm~c��%��P��ӯ��_rtyX�-kJ��OZ�e�}��/�_:C����7����#*�(r�&����e�둤#�K��鯊�H3�;o��*��`UO2b��|�#�F������ &n_�}�',z�>�V<7�ʥ� hW�҇逴s��^�A}�i��w����;���]������2��� ��}��G2+������A4"�ex�k�L�A�A,����{��S�8n�K�G�{���]gBih�Z4�������yƻoǃwvwQ���g6Q�`�fW^�fs��9ƚQ�B�s�'1�^�JP7 U�5�:�6Ǘ�;!�va��*r�!A�1�Uk~ߓ��gdg��Ǵs=��u��\��"���� u��I�1���8�>��G�q�!���l�����T�g�ި��a9����0+MQkDӄ5����c��� H��[�s`��Wb���d%�;�fjBնR�!$;�lJZ.�fn�k .}Ѱ�����.�A�|�N��������i"{���:����W���F��^�O�-��OG�BَL�L�=~�����4�c� (�!� �"6e�j�Z��N��N�2�î��L���c�Ѓ���L� �������+K�SF>e}q*j��J��O�M��4"��0�RZ��E��� ��_�F�*�F-�n-�ъ�נu_��8~��iY��[�77Kv[i;_��G\�]��E�}�f�������E Q��Q�����ѥdv��S�gf��D��'�}�r���y<�az��L1=|g��"�b�$ݲs���k�e�R����3*��"����Uw��ք8�ϐ��HF��w/��r���k����$�)##������K``�H��T��p��П<p�l��#��I�#����M����p���Љ�֧j�GxBp�Y�-j�����x��)D�Ɠ�s&�� Ƞс��_ /멪�M9LW������%�'��LG������v'�jગ%?�wdQ=j��)4�����f�3BQnV��Ku������5*�K�V�&�a����Z�G� �<lqXVq���]�ѯ�:��Kו�`��-�5�Q���O��̩ޒE���nS3O�@)|x����6�q���m��|���x8���ı��"H�82v��8A>�,وa>W�Ѷ�4�����$_ m��ǫ+z F�@�x����[��){�1��jz�� �:���M���yF8��L�+H���RivD�}�Q���ʔ=�������O��f�x`��+UhX�L���F�Q�xe��7Hc�}�S�5��g&SX���`4$B,�>B���2����"��zmi�mw6&A�XMd5�#���-����eI�*S�_4��7��=��UQň���ΗXc�n�����H�k�3�1#3�{�A�U�N��m��C��gJ�x��N� W��̖p�Դ���:�)��x?n�m;}λ�I ���7�i�$���_�V�Q�{����:�ޫ��'��S�_�� �ǵ��Rw3��봀�?A!���}�] 푈�g]%cT�`p벗�.Fκ\���a4�ҹ�����z0������1������" .���!����mJ/P] ����������<L��"���0�Ε��vܣ�E��H�̹����n"���-���!wg��ƥ�uʽY 1�KǛ7gV�rӆ����2e���H(��<E�l W���M�x�<��O(��937��ח�܋��@�\��[��0����b�$h �{)���o� ދ�M� ,ZU����o����EX���#� �s�㽴�C��&w���ѓZS�dw+��¥�6�,�~��_����O�\F�K���e��;�-`�EL,�K*���#k ~C�"d��z�s� ������Ƽ~��٣NQ�*��և&�,�x�L�/^d�+� ��?���� �cy���u&0�7>�{Ơc��JE� -�|�k%��Ġ�����e���O�5!������]a^�mQ��5����0Q�a2z���N�*� ���e�@CM]��� ��\��:_ѫ��1t��r.w6��6�m]�m�g���� ��O��@�MO~�D�I�U3��l����YA�T,vΚ<�q:�2�ۛZ�/��Q��<��lX`�;_b]�9�c��.}?�U����?3�4ʋ`�<��>:[8;�2Kș�y����kRJ���z�-l@�$Q��C+� �l�-�( k ���M�����GOr���)����/�k|4M!jJ��"�юڀ�
Behavioral task
behavioral1
Sample
dd60d4e419f5cd67973778850f1795c2b012402db721d2eced2c697bef035ee6.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
dd60d4e419f5cd67973778850f1795c2b012402db721d2eced2c697bef035ee6.exe
Resource
win10v2004-20230703-en
General
-
Target
dd60d4e419f5cd67973778850f1795c2b012402db721d2eced2c697bef035ee6
-
Size
2.2MB
-
MD5
90cbc16db2d2a2de952f1598b6b9b246
-
SHA1
7eeafe4a7cae2a01c64e35d6e67a4bccb4044c94
-
SHA256
dd60d4e419f5cd67973778850f1795c2b012402db721d2eced2c697bef035ee6
-
SHA512
76c51455dc1325540d9ced83381e0a73a8b0e6053fee6db0bd747ba92bf4744115cc2715de9131d2bf480f07e6a61a034b6bd6758a00cb1979c15ed28fa72e71
-
SSDEEP
49152:nBbPZt2GgcFrdDX3tC6N2veXwXIgHHb6nwDk6rYAY0DN8iur:p2GgurdDNC6w7OnB6rYA9ur
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd60d4e419f5cd67973778850f1795c2b012402db721d2eced2c697bef035ee6
Files
-
dd60d4e419f5cd67973778850f1795c2b012402db721d2eced2c697bef035ee6.exe windows x86
912826048e23709505be0ec735e79e37
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowTextW
gdi32
SelectObject
advapi32
AdjustTokenPrivileges
ole32
CLSIDFromString
oleaut32
SysAllocString
shlwapi
PathFileExistsW
ws2_32
WSACleanup
psapi
GetModuleFileNameExW
comctl32
ord17
riched20
ord4
Exports
Exports
Sections
.text Size: - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ