�GT{��p%��z�m���,ڻu��]|��s�D�ɫ�����hE�"�I�4H|��/�b�XI�7 &�?�؋��������#����|�iN�F5��}ϋ�����R�>�Y vi�-}��{�F��<�e2��~Q�-��i���ÿ�|�]���w+y� �ǣz�t�'�_b�4g�^��-��d3��VJՐ����io�c������Pc�b<-��)�ߡ��G�q��E����W���?}swƈ QP���U�:e�ƢG�q���x�qL�L���yX�n���/.=(Fy��K�[oPQf��?G<�Q��q�K��5�X*�3�X?��)��g)�Ј���*�|#ey��'U�Y�B��R�y�xQ/�1eNB�6��Fb 9(��i��Ʋ�L8��|<MY���s|/�����M �tZ�� ��o�ͩ~r�u��S�M�h���u팋35�~��i,��nv�G|lП��=��T�=����Ԥnѡ������8��_6A����a/ݝ���_٩\��]:����jiU�~��V�@��.��ӡ-�˯&r�"���d��k�� @�����%���i�g����@�T$��i�-A�O�]�1���+>x�I�]�6咉MXQ��� &J�]���4��W@�u�^�Z�7��TrW�%� ���3B�������Ҡ�L�&vy��"�nnWd�n��u���8A�߶�+����s�.�a�S� ���|�i����W"���#w!�[[�r���=������|i~��U�a�^F��'�4�g�sL�q(��a����@[�����< [p���2#J��}�m����^����B�"$C��V?)@�����<7�XUw�,ʩO8]�4���)�>��*s $��Z������� �TYԢ�(m��Y���-A��=�!x�@w����C$)jX#ck����'C���8����+���i2[O�s����/�hH�NS �� X�y��|�i�R��>�j'8N�M���+�x���+� �lѺ;��6������L��Ǭ���o����N@�N�\>xNFœ-[�n�ҹ�a/ �'dV���7q(���C����UY/����c�k�7K[�>G�E?�GV[�u��?�[}��^��~��:��gj�`��� ���0�ܠ68%�+Z@����aC�F��7����=QZ�h��8 �P�b���]_�0I�la��;��|uFWN�I��&:v���E��R�6#iJ�.4f�8���2nVJ��S��n�=�j�e�+�WAa(}�����U ������̬JP�����"=�9��c8�R�l���4�If�5�6ɍ�qk��v�O��y㖯�}p�.�r�֞�i�Y0SHƖ�RY}l ��4�n=����ծ���?���R}̶�LBD�<"1� ���[�5�;����6�I���������&������{F�fC6z��龍Dn�п���0��=Z��c'���~��6ߖo���'CZ����W��&�eb����$Ǧ��[3����<�_�������J`.n��������?>r�� %Y���_��*ݙ�a*�6E�^�<:���,0� �s �ŧB��yQ��r�Jib���p줺�P"/{d^P��mu1�O�Q0B�ߑ���ER��C*���^I�����zP�{�tM5�����OM仨k�M�|�e�a&*��+m���2�ڈ3�TSʐ�b���.����-��Vȣ�X� 12�v㋿w��CQA+�L�%�C'l��8h2�}��nX\����uW]x�'H�Sut[V���v���4��k�h�%����l:�؎/��n��*)IM�@${*3^�&R>> j;����xZ��(�k5�]��f��A���q�X���o��\F[Ϋ�;k�c��1�.M��++���6�1��_��g#�}���2eTH�Ȟ���%���{�÷X����{0�Iϐ�qd�������F������9���r١o�́��X� ��6�7hB�BoD���ˏ&J8W��m��!TQF>*��m�-9/��H����yO�,�u�|+�b����P��q]�^BS�̗gy%�� �B�w ���}p!�U�BE>���2!Ss�`�F���ͧ���C��n��"��}���p�!χI�.}B��(H˱�)j�@�Ջ��-��.���M�Co�`|"��ls��y�����7�TI_�}T�w��/}Ư70�_�d�@vM�tX��Z}�G�:�L`-���q�*��ջ�yu�*^����v�T�����}��>�}�������D��탱��}˷�-�#�8�;k�y�{��_����ٟlҐ��5R9ĬU�7�s��KB�٠b��H�?� �N��8V����y-��\��Bu]���eD]�j,'(��B� ��$�`�2�vD�B�pQ4e[���f�'ʛGFRR|MW�)Xݲ�z�v�����7����_aB�tN،P�B�eK_>��V.Yw.��w�vZ��y�k��+nC*^�}Ş��54L���F��_V*�[g@ޱ��j4��$s�������c�#�C'?������q>pλ������x��@�Pȗt����^����YُGU6"���])AH�(�6SI���[�����y��UH.l�my=��[t��7�����ɇ�D�Kn��4U���k}�q��!�� ��mY�z�]MǺu/ҳ!Q\N4l�{,��,ʆ� ���ϡ&��$�_M�"����� %gzM��c0���|g��<�#�4�@����I48\[�8��n�0�G����$��v�nJ\ɱf���TQDj���c� ����?�At^ypo�z���{��ߥW:- %��r'i\��t���� ��.�%l7\��L�j��l�9�����峊�s\s`(|R:��˞S�L�ɒF���������8���;D�_�j��>AƗaWOM��������9%` ���i]mVhw{�x����<�'z�U��f����,�f�a�n�f7��At�I���y�qƥ�;h� ��� �ݣv��h:��濫o/#X(��:מ0y��\���e�%���`��jî�a~���^��Ԝ3+��� X"bcx�}
Behavioral task
behavioral1
Sample
a8f0345fed8dea9de2e17f1bb8202220486d942875b8d9e3a016ca709eeecf04.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a8f0345fed8dea9de2e17f1bb8202220486d942875b8d9e3a016ca709eeecf04.exe
Resource
win10v2004-20230703-en
General
-
Target
a8f0345fed8dea9de2e17f1bb8202220486d942875b8d9e3a016ca709eeecf04
-
Size
1.8MB
-
MD5
9ae63d844b18679aebf05e18c01cb1a2
-
SHA1
dffa6c56d06bb1854776e0ce412e3ea1a32137d8
-
SHA256
a8f0345fed8dea9de2e17f1bb8202220486d942875b8d9e3a016ca709eeecf04
-
SHA512
dac480b38c10666fbd25ca37a0fb2fd57446c3d64598b79a8b8e4d75d91269bd348fa3a71b894b7217c8399aedb9c793ef38ae815dd590900c51b2b173f2df1b
-
SSDEEP
49152:KqH3c3Jmu9a/wxf9rXvCBYfqwP2dym6sbZO0HM+lNAfILkXTg7P+MMrWcAfUqm/i:K43c3Jmu9a/wxf9rXvCBYfqwP2dym6sb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8f0345fed8dea9de2e17f1bb8202220486d942875b8d9e3a016ca709eeecf04
Files
-
a8f0345fed8dea9de2e17f1bb8202220486d942875b8d9e3a016ca709eeecf04.exe windows x86
74813aab108f7c77f81ab1ad76954802
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord6663
msvcrt
__dllonexit
kernel32
RemoveDirectoryA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SendMessageA
msvcp60
??0Init@ios_base@std@@QAE@XZ
Exports
Exports
Sections
.text Size: 488KB - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 772KB - Virtual size: 771KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 140KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 296KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ