�쑑,u~�%������)��r�مw� ����'��\����b�JR�����@.���*8����y�h��WQ����m��W��;�B�$wL�аhل��9��&U{�֣�Bc1MGoi�s��RBN�j�D�l��K�0�m��������x'����@;����3��tG���i�i��i�ծ�#�9/��W�����|��7O�E~j�ŏ f>����ܬrս��R^de}�6�Fh0@���r2"��͂�j���oX�Y8��2���k��%%DI!gn_�d���7������n-#�D�n@�մ�S�9�bi���v�;����B��O}�{��%>�#�mi�6�����NNc�k���6*�a%�����+��V�+��%�.O:^�n�zk�K���o���A���5�3Y����u;�[�{�t��t�F#��^�e-��� 6�=��4>\*lK������r�48��f)�C�F��m-/H6H�eө�g�0A�K�&��^�D�&��2�ܳ}`̰c\ ��t{��}ܴ��+�PJ�8Q���0��q�+�*(�W�F���G�Ip�_�P�N��|%�SED��������%��,^�A!J�b�G�-�����fI� xp�ɛ����Tzl5w,�DN �{��� �����F�IKN�C��C�]e����[�%��Gn%t�~��o���]q��&)�2V�ìӸ=ᆾ���}."�Hc��s��4� Խm���D��Ol^���Ju�2���q_��3��AG�'T��u��z����%wj��x���.��|��aN���"�T�a'v��B�u����}�,hg�>���j�uD�%��u�xG�Y\�~�����.�i���՚�2��5�hEN��Eg}��qղ y�j�W��GBXS�Wٙ v�(R-�!��٭1��3�9�ֱx�%�'-��� ���M��=��qT��A���+&�zt�g�tꇑ����cZj�jA��o(��p�Z�a�"�[ǢP���]��MSct���������D10�OIm3�p��N��٩'e����y����Ua*y��KM̜6<�@H�B��u2XG�����k�0 `��-��Q��^�AD��2�p0����tݓ�9i?���Ʒ�^+b<��L��{z]�;�[��ʪ���uz��$EsU���6�ǵW+��� �\�O:9����ލ�h���9�}�{OWx�L�m���p ɫ&)��D���:�6�!�d���[��n�Xi�͊�^@����Ǵ5�!@g�'L 6n�RQ�"�w�T�Ҳne�q{a��>~T�f�Zu�d�Q�?y��1Ήf�[��O7mmp:����_���������UY�2��y�{����Ȣb�S\���?�������K5�� r��k��l}Hח!�`s�'�ķ,��[���$�#?9��g�9��a�> 0=՟$\K]����$��jcٰ�~��F��s*P@��I��1nLA��\sʛ����%�J9��i�4e%Xo�����JHEC����3Q��,ǻ����h��h����k� ��a�w�m1'�%��W��!k��V�^(��T@��F��kl�FJ������.{��x`l�0��M���B�����k�����0K|.�*Q�g5-��_���s��5Ob3"zr��>�!0�o]�'ˉ�i��.�s~?��DN)��iԐ}���Dy�ad�̫�}8���x� ���3n�C��j�OF�u�Z:av�ɖ'�Yr�@��_� k.f ��`O��L�,�����y~��k���}�$5���k��������z;{�����������[�i�PR���>��f�Lgn)�B�����x+����X���;��c7ʀ�カ���苙����,�'����`��Jg�in�&��x�`�BP���&��&�[Fu?��P)�z��Q"(�k=�����(���_��m�O�摢���,��VT���U�x`\�(���'��K��;��Ň����$ka%�N����dk^l��D�r`�y��� P� Lj�\8mj$��R,��+��b�E{���E? ?&��p�Lؓ�"8�9|ꕦ��v*�+�N[S�F|㟧�y)�P�7+RGkF;��\��!��A���W� j����x�*�<y~�I��~���ރ�N��V������۷����S��娊�B}����Y�'�<\o<���a+��A��(u ����b�2ov,�n�l2ሬ��H�a�?���F@G��ߗ�BP)B�{��ם��E=�f�h���gp:<((jN�8|�m�>;"B��P��L���s������Zr֣;W��_�X��f�n��M�K��W~W������~��c Sii-ʙ��O���id(�1畻�Zحp����0R� ��%��)<e��`���P9ޯc"r�yyYb$�NL��s���o��<8�h���٪H���{��;�AȖf��;B��u�|�x�����o�E�]6�+=�- z���Ҹ�A����ʌ�U� �d*�����h�S^,F�9�M�[���SH"�o�����V����'i����%hOL�{�G��l-�L/>���"���q��=����\�O$#�����#�#h��B���|��k5ö}�00��ß��w��������U�/�Z+�����1�\���X� [�^}p/��o%=>�H����Xs��A=r����6_e��~"�} �����O��}�]�P�l���-S<���l,�td���P^F%�����A;�J-�V� �T|]F��E��6�i>h���f����M�� ��IL� ��_x8|�hd�kC^R�=5"C5ǹ)�y�-(��!gɤf�B��e� ���p�Ӯ�t�U�H�nU`�YXcc��Qj����!����$��|pF��_�R��}��'SNe��W�����"j?tk�"Umf����jc��A"I���9Oܾ=L@Z>��pԊ~/�� c��S� ����Xms���h���)�T5B�%mI���.�uڠx�ٻ#_���Ҟ\���*"���ۏ������^#yN ��%��o5���A����crKX<�I10O
Behavioral task
behavioral1
Sample
21bbd9d0b3e7536741810a7bedff034c70a987e171f4a96d2a475fdb562299a3.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
21bbd9d0b3e7536741810a7bedff034c70a987e171f4a96d2a475fdb562299a3.exe
Resource
win10v2004-20230703-en
General
-
Target
21bbd9d0b3e7536741810a7bedff034c70a987e171f4a96d2a475fdb562299a3
-
Size
4.2MB
-
MD5
e4883b250f6d7c21319a776c4041dd35
-
SHA1
0ef9d2a2faa489164bc8ce5e082662a942dd119c
-
SHA256
21bbd9d0b3e7536741810a7bedff034c70a987e171f4a96d2a475fdb562299a3
-
SHA512
baabb1d4a7fae73c7b70c9371d23b1000d8c2b122f49d3efc70136ef4d2afd9f6ddfba28f4dba26768156ef0852233523f24e5505747d98dd89ebf784cc336eb
-
SSDEEP
49152:GwVdQuByhQdchA+ikxu1x5bHnaiWt6p49R+mhka2YipXfGCk6CkdWidfMZAubJe8:fzQuaA1naiS4jb+UUidwN1a9oaKacT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 21bbd9d0b3e7536741810a7bedff034c70a987e171f4a96d2a475fdb562299a3
Files
-
21bbd9d0b3e7536741810a7bedff034c70a987e171f4a96d2a475fdb562299a3.exe windows x86
2535a6595a021fd1be61f216280e542a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DefWindowProcA
gdi32
GetStockObject
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
shlwapi
PathFindExtensionA
oleaut32
VariantInit
Exports
Exports
Sections
.text Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ