bS����%u����9�� ^�ш�`�"0z�4$֘�F^�.w@�G�����g@{����Q}IRҁ��c"WA� �u��qB�ja%9�Mhn�V��@.\*� ��f�`� ��(��O���?���@�]R��{��|�E��:́&5�����j`'ֈ7�ҙ�5����c��)-��w��<� ���$�Vp �( T3/+M��F�*xD�`hzl��%#��������L�~'0<���/���W�$�3֣���R\6b�;����ebf$�B+��B�| ���-���g�2��,�S��X�M�� �/>`�,���%�$v��'� ��"�Vuh�Uc>*�0� �~�{���wiL�@g]=���?�͊w��pvD`�m�Y�"�Ľ� �A��J&�r�5ƈ���茬5d�R{nJ:�x�a� Wӕ2��.CfuB{�������ڋ�K�w�;9�����46u�2���������MQOeP��s���w��L���P7�H�}���?�W���d]���x%�)�߹Юt�->`�" z�BV��2JI�`V3jS,Z��V�Kq�"V�spw�,�����2����z�J�@bzM6p卖����g���w��ɭ��5�B�}@�NzXF���yb�#�#�}s�Wt'EOw~�j�s7S�x���ٮ0� ė�]qkX���Ke�z�Cjss�,�*�I�w��$fR��P���P$:���� l��g�*�Q�*�/E'���N�Ha��L�@�c�� �d� 1q���;dTHU9I�b���y�h��*f�ra��0�?�iC�k�Y�QT˒��u�o���K���N�pg��X&��?�"A��ST?}J�FP㌧�s����#�#rp�C]�}�w�A9� ����������a�� kNPK�Zsi�N���g���#�z���E�E�C�'p��Eb$Ĩ=�*q��� !�~�>1�7q,�UA`�N�`������z���-��^�74{���乁�z\�-?2³]�őKW�h��$u���p�$�[h�̀�s��[�AZ ����*�<)����I!�(ԇ�}�)C�߽�\oO����;0w �&Ѳ@xq91��A���;���u[h+�Ucy�Z<������D5w7�� �e���(��KA�\���U�)�7I�Mg��>�>?�u^��� an�J.D��@���χ��$%m���`����d�gc�E�6O��&R %R�aT_N*e�\���]�Y�T���<���Q 4)�Z#�c%��n��E�0�|� :Oz����)f�4����ٓe B�!��Ap���p�I��zYZ>��ky��F�l�.�$Y�ߒ��>J�r�I���&Ҷ��C���}eqJ�|�:O�hhI36Aq�ki@��""^gcUv�h�bGJ-�V��8��Җ�Yó��5ʰւda����2���>�$������)�ĸ��\TF��^ ����O<±ʨ�nI~Q�xx� �l ����D?�B{y�[�@s�L�Ͳ7��P��f/��<�<�bz��M ����㏛7+�K ��uIN��>L�fO��� �7KlE���G u�#je�TB�$��l���:�a��C��jT��]nM�v��;�ћ��k ��GL�ѽ5ߜ�}o������kK��MO@ϒ6��nƇ) ����Z�y�F�z5T�>� H�C�T����x e�ǣP�ٕ*[��/y�J)71��s��"���~��K�;����1?B������D������,�҂e�� h��>~� ��`�h!#ߵ ��e'�7��H`�&�/9�y�H9�H�wEm��Xf4ߙ̸>��T�r�/�-�s%��g�����qhNo��c��V�lۖxH��^x�~t@U`�1�փ���L�U�X��uu`�),��(����<*=��Y�3s�w朤��Kw�ˀ4�(����W��~�cwȀ�M����.�/�P:k&��-��V3_���㠨S�Q��A��x�)�l�+%�³'���X��'hy�7�&�4G�B��ܝM���2yiC��u��$YVHw$&�c�at��!�x1έ��xTdk�2�&���=�v����:T�>� ǦِX�[T'�!H�'c�����.6�#�_�^\!���J@���o�ϐ����W#�$f[��_W�E.x�|ߞ�Zʹ��B �)�xD�4 ��U���R-�W���kr��W�R`�ϸ��K9$Iqk=�W��� )�;Ʃp T@���r�P�����z�kq�����uT�!-�dM��P�m���� �qBڋβ�i��v.tӹ������t�����X�մ����1ĪhS1�_Dg�]DQcyQx����%�ce�m����*4�Ic�(�,�S�ڷBY��?�ӅA��.�v�/:�ϡ�vV8���Z��Є�v�������y����*>�3 �dn\�g�9�F�����[8� "�?F]<����U��o[&��a���A���,�.��s"cg��v*�/biH��N�����W��E�K���$ue�B��`�3���$Xgֻ�[K�����}��LU)�sP�]'~|d����VYuD+��Ź �E��ԩ����M��p*U߯i�l�D�s,��m����EZ\���i� U>��Zghc9;%�9f{�m���6bSazn����VU��`����{}⧺��t�Q�����;d��=J���RD��Pm �/�"��92�)��j���s�ى W9 ��=�2O�Q�c-� G �r���G����m����%Q�K�f�e���A�%1Y<�̱�J�icμ:�5C(�C[�B� fhJ% ��ϗ��E�D4Χl.Q��-m��|V����9-�-����,^���?��掶g�0��[�\U� �W���'Y�s�x��Y5]����d��c�z�hdi,7yU�yjԝ��� �K� �F����\4<�_n�bj^�HO� n�B�":?s��'�]3���UӍ�w���HL�e;u>J)�9Zۃ�&m��X�7F�ίΜ�O/À�v��(Y 4�MyB����ʒa�R��)��jT«z�����-���%��
Behavioral task
behavioral1
Sample
77488521bb305e2e46264a045cc723ee3cbb260aa83b287fe6ce69061caad670.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
77488521bb305e2e46264a045cc723ee3cbb260aa83b287fe6ce69061caad670.exe
Resource
win10v2004-20230703-en
General
-
Target
77488521bb305e2e46264a045cc723ee3cbb260aa83b287fe6ce69061caad670
-
Size
3.2MB
-
MD5
14dc4c9f4aba8be298f8013418a53939
-
SHA1
d4439ab0a237c50fd290fb28f3ec1f1daaec4c06
-
SHA256
77488521bb305e2e46264a045cc723ee3cbb260aa83b287fe6ce69061caad670
-
SHA512
79a373f06ec3b62115c01c96de158f9c60e73a6a7d102d5fba3c62b243553f6098b492b5f6a8184435e32790752ca726a84bf1cf4a3fa7a0f062905eb20c947e
-
SSDEEP
98304:/OTJ6XnolbLDS9QhhGJ837ZIDrcGo16lSYVB:/OTYkzFzx3KcL6lz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 77488521bb305e2e46264a045cc723ee3cbb260aa83b287fe6ce69061caad670
Files
-
77488521bb305e2e46264a045cc723ee3cbb260aa83b287fe6ce69061caad670.exe windows x86
1acfc7d3618d78b093e0324917788f6a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
RtlUnwind
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SetScrollRange
gdi32
CreateDCA
winmm
midiStreamClose
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
RegisterTypeLi
comctl32
ord17
ws2_32
getpeername
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 597KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ