ڶ,��U��6��{�ӆ[Km�e�5 ��0�i0=���/*�eS�\�H���wSU_�R��B1�Ê� 1��N�v2<v;_�ٙFb'S���[���M��`��+jaDE��w���R�%_'����O^*�:=#)3�֍��I�����u��8�YqV���jC,���<�qm����ŕ��1G�y�_m�Ӏ�ԭ|tm��AW����щ��������31�F\��y�.n��#����ۆ)���cM��XI�F��a�����O�Ϋ�y��<�R]�$�X���h�8���I�K������,Ν6��3_�U�H��8��E)Ȝ�LY�@�������6�n�k�$h;� ���-��o����j>�KC�I�J[I̦�;w�r���v�A�y$\���b�{Ƅp������Չ��C$���(a>1ժ�v&� C@��u ���Q��h*����ndN���~��o��/���/�S�M'H9�,� �I<QO^J��J��v���g���n����,�cn<��]�E���ۛaa�-<��jD'/t�Ҝ��4��5'�WN�VZӇ�?܋���v D�|nIó,{��3�i���W.�.��n�/��Wu�ig�PB� ���"$�n�E�������aj"�?е/Be8���Po'�"6MpkG� ��q0di�[A��J�T5o��g�2��K~d{��Xg]�f��\�K�3E0�op3�`� �����GL�N6�s��>��jDE��ܘ~b�Rg��������]�I��j�gmO-��c���=gH}rD��G�K��2 C�+UѶ���`v�(E��l�|l��d.��VL8$��BH�Ec!>��9�H9=�⩸d��Ɯ��m�.����e��*�FG¢���L�ml�����g�,�B0W��~e��� sV�=�֨�]�lGm��ѥZs�u`lËx7����G�ݴ��}S@��,(��0����i��q� M紣%�@V1�sf0�ga����F3�CJ��^~�p5(�U����p�����h%ѷn���bw�L�ȓ5Oɤ=������+<iČl��!�&�G�|���������r�+4�Nk�U˨x��A}2hf�"���w�/b1�\"hE�T� ��3�TC�~�=�s�S��}���<����dЦ���E��e ���e��Ϣˉopu�� �>������\�- 7[�/�~�d��nh���99`#1����m���#�i� 2��\:�\���2�,���vpBX������ȏ��J�D���H���I�8z͟����n��au��/ᥰf5H�y�ɔې���w����;�m-�:�k۷h�0]�쾽��h��T�~u�==L��z+iG0q��,�e�[�ӯ�PX���&��b�`m��j{����� EG�����P�A��ׇ�����'��M�Z�v)m�@ּ/6��"S� �?���D>Z.t�2y����4� f�_i�Ŭ��Lc�V�fG;7��ջ�T�r^�`*,���Ӗ\��٠m6�ڣ�UW�T�,��Z|tݑ�M�i�h;uA3˾&����:�����<��-&�c�~��3e4]m2�!%���������lX�����w3�s�j�� ^M�g�]0^����Q��ayF�3l3�Z�L�hT�,�i��{�6�J}�Gs̑A�H���_��;���H5�(J-� �=���)qYks3.��!�dʵ��g?`}�Q��M|�����Tj����H����I?�Z]����Ze��]no�N]�N[KY�7�zX��m�K�9���4تM�%�Hf�?��ۚ�&fԨ���k� C���`���3�R&M�$�k3?5�A�|NX�i�ӯ��o#F�AJ�|�y��d�v����y�F,N���X��H����u��f��T.�$�nB���e!k�?ӻD��T1��7����.�[?� ��%Rz��1��_�ɧf��e�g"+CSi ���O�@8��Sy&b,�,(P:R��-�(-���l�`5��/���`����f��K�O��_~ῐ�3��.)jk�. �+�p���/���UA������g6IDⶶ#. �W8�X]0��p��C��n��+D;�g�Cv��I�<u%=k S�}�>b����)b@�8]�k��fn�����y��Z�_p�������눨f���t��o�;̊r��/�j��P��'3���&N� 4����� ���oc=�m�H$*�y�6�qu���r�L���8`�]��~�;=J���� z�%`Uѭ��rJ�UW�{��/���2�|�x�������Aׅs*,�V4H���<�v�Zk�D�b�dY�_[�M���Ru)��ǟC4a��X<��Rn�d�Nix�j�ER�m�ls@:�����om��z!�3�Ju7s�:2r�7��iB�|V�z�T-$ Է�[.k��I1��ۼ|��=&zL�3&4�2QzEwqrx�uτ���,Ɔ���\x��x#�:�P���������}�lt��~-)ಶ ($�y�Ay�wեk�o^j�.1����$��=1R��4ZI�)�|h��d�'tZm�V1�����YT���$��������<�\� j5!8�2E� ���m��F�e�]9��S��M�@���A���R�~p!��w0v�)[�A��>�}���� /�� m������������Q\r����B����m�������O�`��3\:�h�3��~����c�?��tՕ�Dw/JD&�B���gBl��6' I�\8FԘ$T�r� M��ÿ�8�l\���bu���ӬA$U8���,�"���������ZE4��eA����ڢ���9$�tg�K�ݚ���/�������1<��:�.�6}?`鴲�,aҡo������Z�E?2��ǝ,b�T�*K|Wr�־����xO�=�E�[�^.��;��\��Ly'�5˷��R���X���+���Bs%�t������Rt�Hn�k=5Yı��Vvj�h�&��>��ѣ���T����*�P_���,�B>▍g^L�a"i��[�J�bt��r\�"�"��L!�p�t}�`��*�],9
Behavioral task
behavioral1
Sample
3375767161b3b427842c995a98a98beb09362ee1ff470bf574ceee69106d0e5d.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
3375767161b3b427842c995a98a98beb09362ee1ff470bf574ceee69106d0e5d.exe
Resource
win10v2004-20230703-en
General
-
Target
3375767161b3b427842c995a98a98beb09362ee1ff470bf574ceee69106d0e5d
-
Size
1.7MB
-
MD5
50faaa9eeb829d1274455f64a660af0d
-
SHA1
d7235bcc03501e75bca4afd39a6ff14707ca990d
-
SHA256
3375767161b3b427842c995a98a98beb09362ee1ff470bf574ceee69106d0e5d
-
SHA512
c7b2ef612cc3a55da2de667c331af36bd394ce1f28f80332640bafc7e8d36a7b5bc5aca32db7efaaaf8411acbc50221cfd9b87671c48cfe2cce5faaf02251fc6
-
SSDEEP
49152:ZfaqmxNR7rVnCuIUfXxR1MFttORGBUgkz9XVdtqpL5W6AWFShGyYjRXJiKX0ycWt:Zfa3xNR7rVnCuIUfXxR1MFttORGBUgky
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3375767161b3b427842c995a98a98beb09362ee1ff470bf574ceee69106d0e5d
Files
-
3375767161b3b427842c995a98a98beb09362ee1ff470bf574ceee69106d0e5d.exe windows x86
56e897cde34ea5218c906a501c1c3eec
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
SetHandleCount
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetCursor
gdi32
GetWindowExtEx
comdlg32
PrintDlgA
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
ShellExecuteExA
comctl32
_TrackMouseEvent
oledlg
ord8
ole32
CoInitialize
oleaut32
SysStringLen
wininet
InternetSetOptionA
Exports
Exports
Sections
.text Size: 468KB - Virtual size: 464KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 812KB - Virtual size: 809KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 152KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ