�a�Y:.�c��wR b(GﰡWp (�$���D������ ��2����<��J�?jGP%Iz�0Y�`*=$��^H�9E���&���@pM�Z8n�� Q�d�q��B�L�����xTy7���d��pR���cA�H�*Q`��8��AL��4�@T��4�qX��t��� `��>���W'�y8�������@}>���r�ȏ�W�z�[��&(B����\o���ˎ�ʛ�ۂC��g%����e�@����W:�$� ��4`}0���R��Yq]�Z��<��$\(���[��#E?,p�� ��f簥�0A�4n��p8$��Y���ك�̍w�'�`4�#�,Xu~1�#��f*�GAL8 AP�`G����6byܸ������#[e�l!������T=}�s���"���+���xr���z>9��N��a<��=ۆ�P���0�`jY��]+\�R�Ie@��x1�d4ƞ�� ��ܟy�u{U:�Cq����\s25箩���� dFRyh2]�����|�.}y=�Vj�;��@���x�l�Z5h]e������I���b�pK�*�_��-���Ӕ|���W�фf�>�cIA�tW�������f�1�Ъ���T@�B>���J��S�`o�[W���_�\��q�P���Ϝu���H_{o��w��Z���Dp�y�-��.|��Լ�@������h$1`_����'����;T�ϕ8W�o��̩a�����4�w���Nh�n�H�{ pD��R3W-�����:�-;��ګq�Ӄ�k^��Q$J�Hq���ż��zl�7[g��sj����l2����D](8MP7C����������P�v����E%�� �q,�d�v��Ò�1� ��ݶ/��HQPe%왐��ƞ�R��p��&Z`�^X�ȇ����x<�T���·�LO:ֿD�~51�_aD����a��������(e�41@�)��I�Q�k���,)�#4?�U9@L����o�D��6"[�"kهʚuA��[�/���Ew � �W>K3����y~�O��y�7�5vL��m���~ߎ@m�r:�Q��8�L�w�,�JF����F�������f"�|?A�52ɘ�- G6�wD��g��� -��Y����N��S�y�� �8��f\�e8��MTm��^�k)�]�S��k cP�A(��X�j"Wʸ��W�\�mY�6|�U�i �{Eэ��.B;G][�=K���U}�/pN�&m��g;U܄6�gxQ�)��߾���T��|�3q[3&�d�E�m���9n0���j����ҊϹ���RSi���'�iy����Z ��(���u�c잮��mdYB~?/��'Ģ��D�����`��:�� '�y2�+��zk�R�����3T�k�d�V� U��8��s�݃��ϥ��9$�����2�kȃ9��(͜���L�"�qE��P�(��>��gD'�����!�'��!b�����cy�,����fd��Dz���#z U�e��L_Tb�������9u�Qwr,UiUH�zXI�m�f��S��Qi�W�C��ջf�GT!╳��?��h�cŬL�i.���$�HE�{�5�)6%!:@o̸�� �I �$[���GMY�������Ԍ4)�C���&�:��d�y�N�fD����)1���������* gGu�^)��+٠PIkJt|ᄍk�&{�u�{���C�` G[��n��D�"nh�<���Q~¸9�E*�1�J5r���CLH{�l������藬N� �;EA�>������n�����d�T����ZҔ*j�*ܵ�J�,���4��� �T�g{Ӛjw특|D�Q�ur�� ԴMO2��'�!����[5�X �� ���p�����@u�j8ߛ@0�Z�����Q�����ChI�HaȢ�v��GQ�շsrYh�O�Fp�m��9�Q�$���<�G(~[*7:�H*.뒧5^���p�*?r�r��p-)l�e���̸,' � �G��%�b����6�\���a�s��erO�.6����U=��Q��H�(�I���}��������44Z2� 6�c�s�V8�Q�L�í��)"C����w4+w�r�w_�����Y�=I�+H�գ��A[��+_�yQ��#A�U���Laɰ��B_��h����܂��<�b˳����˳�,�f�_2T������;q�#���%�o"��+��D�w�,V��H�D��P+��-0( ��|iH(`��[�`��Nb\(��9��V/�nxDk7�j�����Q����FO&�f�>�3�J>�g���)."�m�{��d[�C�b���� n������������^5% ���@.����3�/)���4N���j8'�Õշ����E��4.eT~��͇�f�+ <�00��wD�턃��%qx��?��/���أё�vh���QGdް�%��d������\��ʨ/?�����蹇����e���jŃ��1��tt:é�۾�m��pj�I� B\D@��g�^9hX����N��I���U)�� ��#]����6l��lU�sP�_�l0��^��I�1oqW>rxhf#3Yڀ�}U7Ͽ`r���#��9)����r�Z�3���ݝ�z�u��z0#�����ۧ��n����p��*�S�m�%ǎC� �IY� M_57��[�|�O�IĹb���4ad���J`�����c�d6L���ܚ�&���"G�hw�h� �d{O���e�qTS�9�[;��\"@�l���e�=��M��e�J�K��a�#�i*7���)�MD�列�������|���� ��(�x����V"�4R���� :q���s��� T��#p/t��U-u�(�Ȱ��ͯc��S�߱�Tvd��Պ=��;��0�ɰHô���X��;-m;�5y���w��� �麓G�) �gl��8�X|��Z�7�>"�U$G���#��I�rb��[_�x����v�^�<+T� 54��2��f7-�ٲ������T�&�����
Behavioral task
behavioral1
Sample
45f378f2df9a1bd575d6020b3e0ab721f64a4815e14b8c607a818c653738a6f2.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
45f378f2df9a1bd575d6020b3e0ab721f64a4815e14b8c607a818c653738a6f2.exe
Resource
win10v2004-20230703-en
General
-
Target
45f378f2df9a1bd575d6020b3e0ab721f64a4815e14b8c607a818c653738a6f2
-
Size
2.4MB
-
MD5
673f51277842bf477314e09affa89520
-
SHA1
eec74ea50cf9b384d69d912320cb853842e44469
-
SHA256
45f378f2df9a1bd575d6020b3e0ab721f64a4815e14b8c607a818c653738a6f2
-
SHA512
14eda7a0a365eb92398726db10a24be879d06e6e49267b0dd1852b79e69beda6677e4754b8ed9fdce2ce615ce262e80fd8738c4679396607e86645af5bde4686
-
SSDEEP
49152:IjKm3DPYO+g4f5HQeW/r8wrwPR62BVyDpUoIbBXLXwc3j2gZw:2KyDPlcf5JOr85PY2/625b+cKgZw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 45f378f2df9a1bd575d6020b3e0ab721f64a4815e14b8c607a818c653738a6f2
Files
-
45f378f2df9a1bd575d6020b3e0ab721f64a4815e14b8c607a818c653738a6f2.exe windows x86
d2d5ef3ab234f83e6abd0d588ad58815
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
SetEndOfFile
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowPlacement
gdi32
CreateDIBitmap
winmm
waveOutOpen
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
ws2_32
closesocket
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 579KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 930KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ