rH�m0֮�kuq������P�<��#��[����_�H�8���Ͽ� 0*���'��榖꠱��î$J朚�IJ|����� P��Ż����70�U9;�&�����d�����6�?�31�H��_g0T�s�պ�I��o���P#���]}��!���l��~AS!Eif�C�b���6�*s��l�b�P�:�3x�<j�;��E$�|���w�{��S���' X��um?�H��@տ�C�/�.k,���#�N6"��� ��ɟ���3���տ�0��M�?��x�-�J��*�R�D��C?��[ ����s�IU��Uc㖞gM)���=]":ˊ2?Ӱ��{s����FHJ�63��6�~Otg�LX�!R�ֵ��2y]5D ��&�~4�C c��������k>�k��MG���w�z����H� Fu;�.$=���x�����l�)&�y����>���f=�f��*#z�"�� ��BQK�L�'���Nv��_����f�Meaq���J��삍B$��e��w�()v��H�Mw\Rm\c�ϟ#�������*�˶�q�p VX�B��g�� ��N&$����ڤ{�J+l-�A/���1�E�ʹM���1�m���uc�ż�&��k�^�/�&X����gם��]ߣ�Մ�:����z=�Cf�t���� ����i��K�n������Π�3���սja-��4S�}P+P�+��%��(/��G���X�ّj1�P�B��������Z�^��ؚ�I,�3r��Okwb���/9T-�-ڌu���ny��ټ��R����EU5�+��#�阥6|�w�z�#����˿�r�zD�x�����4�A�BZ��T����0:�K���G�hDL;庭=Ɋ�H�N��1j-b{���{�����M����QoET��~a_+Vg�X/�4�$��d��D��[�LE��g�l ��o�=E�RM9�\�n�������9q���� �B���9�*���Q�ϝ�D� fbͬTB���ȯ��N� ],P�{��$��l;؎��?���Y�@fR�.o����l��ٽ�cMp�A�vW2+ȼ��7Z���͐@30��`��{��t�.���͏�����PM $>�^�\?�^���z�C6�j˥��<]�}��� ���ļ��b������(���v)�!`[u�x �LG��v¿`CAGH��I��Vn0�U�]A;��L;�I�@]*N�]+\j���%� �7|���'j��]I7KP3D=UƯO�8O�a�&��5�舂rG��lWzG%]��P�Ӿ�rЛ�-�x����Ҫ����4���mAb�z�=��fb�,�N�{vo�D i~fU����\����LV���'��i5GY�~o��a��6���2�����[�T`oB�`<������� ���[�����($8]$�l7K�3����hd�8+����@]U�P%��`T��m��v��i��H/k��a�ﯛBd�$�+�H]�@VY+�F ��ڵY̕�ȴ (�i.'9]⾋�?!���)l���箋�H��BTEm;�S+9�j�C��6��qc�xAS%ģt�N��^G�،,��/�Oy�Sg�������;�O?�KF�� '�c�<aop��`��9�z�f{Mj�����c(裡���T'ݦ�~G��;D�3�uaP�����h�/jT�j��[����D"�2U `��I� �"`,�H�'2�a��c�r�Θ����e��s���W�ZlH��iF<�Z �c�D���� a�Ɗh���բ�5��{�cA�E�r�����'�l����yh��q����]���Jb��p�"��_3;ND� �;:��3"�K�����V�@*kxsu�!߂:������'������F zLl�nz]ԶP�ٱ�Q�hQ�ǎ\��-c�EmQ+l H=i�����i�I[��\��I!���wu �~.�f��}C��7�_ɃX�)e\�+V#��Z?���W������;Bp��+qJ˒yR�0�L#EN�Ӯ�,�+cq�gVy�~��%�7��|�d���$��fg�Il��O�i��>?���효���V1��;<K�Yl�4��/6�(�gG���2�5B�"��ޖ�Y:T (\i=�D�K��#�lƶ��'��7aPqXQ���IݚL�XrPmC�V. +�ǻ�����dE�4��:}�j;m/h1����K��q$\a��,��ٝ<�g�9zf�W��j��+��絳�\o�;�T��B�dк��~3��Zy�f,:�w}���ON����~ἴ4<Up4Ӑ� �t���֞XY8�/l#u��26m�@%��oi���g�nd*��s���wO��3�PΓ҄��z?�u[rS7"���^�2�o��a��[�����M��P A��뚈q��'��wz6�9�$��L�&��� �<��͍��r�� �.�q%g�mM��l�Sм����-��zb�p��3N}�b6�2���+�x�i{�4)<7kf<C��C©�P+�鄳�:X{���yT�y �g�"�>��Z��-��⽋�/GOX�w��K�;��=/;T��v�������걅�?{��0eg���*�H��Z��A�j�( ���&���GW)��K-����n��fb��:�y��L?�������ؼU��0pk4rl�j!���%O����.�x���0]?�|: zG�IcC5+ҍ/8�u�M:�J��6a��Qhb�h3ַ��ie���biҧ��}җ�8�j��g���\� �Ѷ*�%�����h>z~&ܤ��\�g��KK�V'fg�����?�6��O���&��d���(:���"��.s�Ρj�:rE�b`��Bұ8H2����n����⺽����fCj�&"�q��tAC��?'��.Y��,�?v�qA�8���u෮yӚ�Ӣʎ/i��6�~�'�����O"�7��EX��j��� ��0d,P��� BN(����ι�����&���8؋���?( O8NP !�) �ԍ������Nf������/Vj���d���)��J�D���@��=+<rB�G��CK���
Behavioral task
behavioral1
Sample
2dc6d67519f5520d3bdf0a80457d00b95b48d43e847c36b2f77ae87de1e51fd2.exe
Resource
win7-20230712-en
General
-
Target
2dc6d67519f5520d3bdf0a80457d00b95b48d43e847c36b2f77ae87de1e51fd2
-
Size
4.8MB
-
MD5
2d7fffb6c4a543c911c287303fac4158
-
SHA1
b8f3a6b0ce222bbdb42b58331243d321bf49feaa
-
SHA256
2dc6d67519f5520d3bdf0a80457d00b95b48d43e847c36b2f77ae87de1e51fd2
-
SHA512
c1811eb04a4630a2517fa53ef49c665494b6bbdb557394353f941c3c332d2beab62faa63d6700909adaa3ae717619df19bc3b7626ba6b9bc1209840aca21d1f2
-
SSDEEP
98304:UpB0ce3DHAcNzqX2EI6rgMH57DUXXxARjUdkiOeaC30jBXe:ZDHAQmmPS5MSdHNjh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2dc6d67519f5520d3bdf0a80457d00b95b48d43e847c36b2f77ae87de1e51fd2
Files
-
2dc6d67519f5520d3bdf0a80457d00b95b48d43e847c36b2f77ae87de1e51fd2.exe windows x86
fb4ed515d3525afd39fa10a7b401895d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutWrite
ws2_32
ioctlsocket
kernel32
TlsSetValue
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableWindow
gdi32
Rectangle
winspool.drv
OpenPrinterA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
VariantInit
comctl32
ord17
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 929KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 394KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 364KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ