`�#����Ԧ���SUTY���1�[ Q�5��gZ�}�-���>D+�9�z8d�@r.��̃����/l� &� ��]k8���d۹�������.)�`�|����w� A�������\.F�w��"�j������y�4�$4!��m�. �)İ��^�߷�{fd��+��vI�u1��腲w ��iЕiݽɣ���R,,��l�!�~d/P��;��r]~���ˢ��(�����@rt�_�u�E&lcΦl![�c��N"e�ߜ�^O��I���*E`9)$r��/6���N�4�����<_Z*ј)�(^j�m<��h��q��<v�Qg�=4�T���p��g�b��|lJ��������3�������֬l���Iv�������S��7�j�k�:���o�9�6'�,ܕX���T�vc� ں��u�c���� ,Y�U���'ZG��(�[��`���)@6��t�4)+�+H��c��v�����O���6��f!��֥~7����z�Ge1�%xVECfG�t���C�^���'�J X��I�au��d��D�4@�<�ৄl�I��"�n[�U�E�<f^G�?�B\CT@�6�A�|��>j$��*g�6m����><3��|��^������cq �4�l�$oV���q"����7�6��1W�Y�9<(u<����Q�y��Aa�]��C��O�E3c)�)�o��-��<�V���ՇxB"V<R�E�Nj���r��@�f�.��������z~� �c��;HsbZ�,}��4hfu��)p��#��Hgi��`KU��*��ɯlS���!*o p^��б�j�e�s�8�G����O��uT}�w�獁>�v�����D:��4覤KO������F�Z����rzm�=�p �'�������2�b��r��~��1)�����H#� �O�f��_w���7;e>�Ա�C�V6Q���2#5��ͤd�lə���T�ɨ�?d�4i'��!�B�pK*�������T�W!F�n:��������J��R��r�MD��<���i�c0����kk��kS��]�����8����� �f�8<a|����F�G4\o�?ʘg�O�P�kj�tb�0�H��w�^��7 j�$L�Z�n���@=U`������J�ӭ��m8���%B������c�6i,1H��Ȭ���J >f�k�b��1�W�z��+�����c�1ݮ��Qz��&�(���e�<���Q��94vEc��É�:�2d���3���>L-����:_�x����K�drF�F����/�i1$2ٻwcٛ�M2� (�5G���l�����H��|�F� �^���:��TV/&`�3��4���b<1BՄ��x�ݣ�v^H��ό����~'k��HQ�+{�ѝ�/��lIj馹����q�Y�E�������r�}�&�RC�� 5B��ǡ�>NY�`�����p����X�w�e�����!��_:g˶^�����o��Rf�����P=��3�n�=YU4S%��)�2`��n_[IQ��M��I��h ��q����Β�56q�K�����e�u�w��h\�e|tiϰ�v�Q�>�=��s�oVSnK�]&��=aA!���i�?�L\57����M��Cй�"��eI����̎��y*����vl �=f$!����K�;��{X���$ό���s�,䴪��i���Vdž ������(Q��i�˶f" ���4AI����~^����njk����YBB� 1�?h��4~��e5���6��"/zC�p�|��ˇf��˾a�W��(�����Ҟ����]��,�w�LJ�k��˞7���{|��050 ��ܜ�oc\�=�b����m`N[�l b��1����$��SoP�[�kef��:Àt�p�s/X:5I< ��YaY�V��MP�;�R�>�<a(�yE�q[�&&C��%B��?B"��U� '���9�о��&[��!"#;��U�V�j�Y��A�c���R�_��;{b���������g����-�k�<��b|E2Yq�+g<�t��ŒA� ��_����o�������F2ƻ:��8�E����F(�#���������,������Hg�����"q�8X�,�������c���o�:,���_\i;���P�ih$������Ǿ���]��K%�X �;�3�&*� �L��ZK�Fn�Bv��Oιr�~�!��?�re��)�ǘ�*��x�2��`E7�����=�Ek�*�RU������ِC�}�o(_{�x46s��hY*����oA\0*5eq� �c��ɚ�c��fG �@$Q]��:�=�~u�����FhPeY�N�L'5�m���T��[��@z��&(!w���a)���hWgn7��t��ĞL[����I_����x���K\�£Aw�����cf ���l���[3���۪%�p*�X�{Ka�P��"���9��wJ�(1"|&ؘ���Œ]F�M����S�p�h�2�G~I�\sy3k�z3m6b�$N�ʤ����e���e��� �H�2�˖��%+r�_^2W��2�V�U[�3#�@Qr��� {�MT{SEr�*�@�m�K�TP0��U�M����锏�5����K��s)G�,�!@$�eVS��!�˗[T����Cٜh� ��E�m$�$f:w�G��v�E 9�q�@������;U����)�yP��|Dݞ6Wt�4ޮ]J$S��%��Uq]o+�`�u����s���L�<�ֲ܊��J-&��m⣊p_[�U�F�� Ac(�n��_������:Ǖ^ ]h�0S���W0���!/G3�h����sx,{���Z^L��*���:�����U�"���oT�����'��͵$�;�ۜ�Z���}3]� n�4Ns�c�.���EB'/��-q�Zӣ?�@��R'�*��~�}�j<��ц��MT�,TT�"�A���>�ʘ{�ʝ�~LzY�_i3w��x�1�����9�,w����1���I�����.�9�7�!����T���2�ˈ����^Z��Kl�7����"���O����
Behavioral task
behavioral1
Sample
620db583b1d8a7afb6f96f4efa5bef7b156927f69ed7e8ebb24eaf08abb95749.exe
Resource
win7-20230712-en
General
-
Target
620db583b1d8a7afb6f96f4efa5bef7b156927f69ed7e8ebb24eaf08abb95749
-
Size
2.0MB
-
MD5
d9a2b38da3df767c2a94f37c3fefa3fb
-
SHA1
e38162a332e0df79a1abcbddacdc1512b7dee282
-
SHA256
620db583b1d8a7afb6f96f4efa5bef7b156927f69ed7e8ebb24eaf08abb95749
-
SHA512
94efc3a340ee5e81cdac688ebf43be94309c9419aad41224bf3b8f127782461ed34d713cb0a8aa0625d8ef4ddea2ef1dff51ea6f4a212cd64bedb679b8eac7c8
-
SSDEEP
49152:WpYhx7U9CpD8W14ayaxzhs3PD8FCDl7xO7nL:WAjHTPw3r8FAuX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 620db583b1d8a7afb6f96f4efa5bef7b156927f69ed7e8ebb24eaf08abb95749
Files
-
620db583b1d8a7afb6f96f4efa5bef7b156927f69ed7e8ebb24eaf08abb95749.exe windows x86
ca38d70795caffa6843e3f72333719da
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOpen
ws2_32
inet_ntoa
kernel32
WinExec
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowRect
gdi32
SetBkColor
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
OleRun
oleaut32
SafeArrayGetLBound
comctl32
ord17
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 929KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 394KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ