��p�O���E��ܧ"6L��ys�y��w�ڼE?�ߌ�@HnP�b���C��8&;�lm�b)U�w��Ǝ�O�O�k�s�:P�+@z�YD3�R���!V�R��v��G��8(�}[�p� K��};�5&��72�Y�l���C�I!E�=��?>4�(\O�58�)\��?��g�/픭��+�1�/���.�{��)���0�]�ƒO�]��Ps��Yz�����U^�^�+A^U� �o�9�l��q��qӗ:�@V�%����*� �#5�UF�v2�.�l�w��g��7Rq<b�w4������f�� ���}g=���P�A�t�-�b��K�7:,:ذ���V��J����pa$����hq<5,1f���c�?D���]�����3������zP���Ҳt��a,�:L���[r�Kf)��.-�������u�7�1R?��8O�.1l��8 xO}B�kƶ���� ����|I@�l�*�� >.T�q�V�+�<�K^j^�� cYEY������U���T@� �sv� V!\4]����L��{3��u0y�ƚo�DZ����-�& �}U���[�xs� �81�KDB@��Nb�i~m���h#�'~���j/ ��D����i���Z�]c��1"Jxfƨ� j U(�b��e��v����~����4���2��"�$� R��[O4�)5��f ��f�`�95Ϡ�_��eb1������Lu��+#2�NPX�%����Q>���6�O�����r� ����c:~N��RFؗ����s>,��ES�4�c�5m�"9NG �K�G�Y��ۏ�iC(���G�Z:���ήi���P^��H�0�u�����]��%�+խ�����Rlҏ`Ϙ�5Ec��,%��d�L������:�Z�[�/8C��:e:�- pi6�����`ӊ.�$$9���̸&�Y.��c�]ԭ�hQ�яݹ�D"s�� ���&�R������1��5�����;wBv�~T�{k�҇^���tX�Y�{`��/Zxa�\L�L5 z���h�hX+g�$�"q��M���<��:�{� �]S0����_�)GQﰠ�=/x�yg# �0�#�Lle�w���t�����1����֕�J|�s1��M�X ����p%k�5.�;^H^e������Y3&�e:(�ڥ��D�A��>�Ͳ���v�s�{�W�[�v]�N�m �ߪ-G�����5��qRBi:X2f�M��i��~P+���q���r��4D��e݅�/��i�np��5Ac�-�Y���h��D����Ǹ��4���(� siN�N��7:�U�|�VDZu��HjN0�6�FQ���~��s�I��+�:]���'��*��f8�����C|k�ț����T�u���y��fpQx��,t����t�3'�ʿ�\'ƭr�2������88e:�[�G鰪+߅�(�*��l_w�9ɚ�Ǧp�l�DбW��a�(�z�Wֱ����~$��(�ؕjWt�V�w�ԙ�0�������=�� :�3�zZ6�h���6Ԟh�,/��o�u��ш��ۣS1�y&9z�s�C:.�;>y�^,y�O���B�̪��������� � �p,]���M��J��<r.�?�܋��e�N�?%��fH�i�L �>��1ֻ��(v��5�Ao�7����� z)��v���a���~d���0�d�+�Fx�Iz��ꢚ{D#����"�����) ��kJ�ؤ�b 6 �eZ�t,XDC�Q��H��(My*���1�N�@Lzc�� ����e�p�}e7��I� R� "d\m{�{?�텋ڑ�R�w1��Ts}1z88O:���`�������K���9�wͱ��4'[C��ˑ�.,0�)?61\P�%�*��mGA�H?v!�2]��D#�cp"�,�&M��2+� �!h1"Dط�Ld|��YE�QS��"��f:N�_3�cs����\%)[G��J��ʕ3AJ��<�y�oN0,�1�}Q�n��T2l�&y�Hz�{�2�{��n:F�]���Ø����j����[ s��#�nNg~YŬ��L�}N:R�A��w�??\f������m@���#A�u2�"���� o1�8\H��$GW�e=ɨ��AɄR�@yW����'^��ó�D�HX�<N�J���k;~;�2|�.T�� ���$P��-����\$�n��e�^� N���~��[��� +��|�������S B߹�X�{r u��L;��W2(H����/�>CR}ʨY�9�ȋ�M=��U^IOf��y+�PG �E�2�@�8s�V4ǡ91���G�ma��X�9+}w���ҐD�� �r�v �ۈo�&�I��0�$�i��N Ȋ���l��dSlf��0@g�1��q#�[A��"o� �P�E��oƭ])D_ƢS�$�UtDŽ|š�@���N��s�\p�/1�$��G���H�t���o�6�'�!���*p�+��>u��]W�ȇ2�y�,��D���m6�e F��.�u���sAr�^A�5 ���S���-�|� ̏n�Z��Iű�����9#��]���\R�_�*Xo�:cȬ���K�)`��%�'L� s�x�z}���}humH-z������W4lz�F��>��=�+�mD-�;'`8���BS���ᬹ�ac�&Z��_J��x/U�Ͷ��D��S��黰 �4��!ٛ���aq2VJ6Ί�T]��R����^/#��sq�����"Rڷ%N#ͤ�ch��`7v&��NG���b�5��I`����f(�Ϡ?BC���/c��>("�"�V]��V��� ��SiE�FD \O��'1@�^���A�����m���?��k��쁋�G����E�L�l�~�C�����C��TyBr9����ɣ����=�g:�z|z�HX])��@0�H�&��P��t�ꟺ]�D�����$�Y��R�A��� ;C�0 �-�ΪW������{J��*)\E�_d�%c1��5����+���������側��spɀ��,�FT�W�`���|
Behavioral task
behavioral1
Sample
ef7d6cf27433660ba12f19884c6ee332a70965d6180b61758a1a2a0c2ba66955.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ef7d6cf27433660ba12f19884c6ee332a70965d6180b61758a1a2a0c2ba66955.exe
Resource
win10v2004-20230703-en
General
-
Target
ef7d6cf27433660ba12f19884c6ee332a70965d6180b61758a1a2a0c2ba66955
-
Size
5.0MB
-
MD5
20be07fa4ac890f8a5584d676d17ddcb
-
SHA1
42aae254bc4de403f705f71e6cb841d12578dc1c
-
SHA256
ef7d6cf27433660ba12f19884c6ee332a70965d6180b61758a1a2a0c2ba66955
-
SHA512
dd2433beaa3b10377e80ab278c8f0f7a0c20f2b0338918e21ae462ea1bf755a982e6d93897178f98421f96274a86d85c7acde8e8a8baca3cac0fcfb244eb667a
-
SSDEEP
98304:gyxtjFlGoWNneI16Ds4RBJzEiO7Jh79zmV6Mn5k:xxtjWoKeUXiOfVo2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef7d6cf27433660ba12f19884c6ee332a70965d6180b61758a1a2a0c2ba66955
Files
-
ef7d6cf27433660ba12f19884c6ee332a70965d6180b61758a1a2a0c2ba66955.exe windows x86
6e83b49bb050c6ba742436de990ac041
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowLongA
gdi32
SetViewportExtEx
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyA
shell32
ShellExecuteA
shlwapi
PathFindExtensionA
oleaut32
VariantClear
Exports
Exports
Sections
.text Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ