�d��/赆���7H���4t��ؒi^��b�>Aѓ���O����C:��O8��R�E������c���� %�����G��\E��qq����z0�l_/e_�oYM������ .hX��-d[�ń+6B�"_T����������������㱬�o}���vL���uj%Xr��������B[����m$����X��)�j�. ��S��F\pRx���ܢ�<2��U,���w�P�Z�(��h����q���M���:���bO����~P]i�Gek��C�l�a!��&��+�XZ�?C�Đ�Z��xw4$���<��R��T����3��ę&���L3Ufe+��r��j� �e{�թ�q\D���a�t�:7�!��|����6V�r�� u��l��@�ՠ�u���x7�Nˌ����g�)����f����= �r��]l�M�O j"�P��ņ��v�a��]��[���]��t��O� 9�x%3��7� S���OŽ���gn��ztĭ�ŷ,��Y5� ��!��*}�t�}Xxе�Y*]�s{��������{m8 ���]��;F g ����z���*i3r6�&d�x��Qԏ,*ÈтG2���=����=/(�L���I�MVs73I��g�4ײfh,���sDF�9�Ɛ�(&�MQ� Ks�Y�Q����sT�����piU�������kS=A�!���* (T�ฏ~�2������VLN�[��8c�P��i:aG���c�C��B������%ϥ5�^�9�B%��\4�S���2T�=����n�x2�3�?�O��~�O��2���h{5�lԅ%��{*?>��-)�F��p'(M)y����e���J���c��́���'�R RlS��h@釰3������ng��P�^w�8vX��;�f.�Q��f��9@>1��i�G7ʫ#�_��Ȅ���+���X����4��&9�k����:��)��5M�2�а��S[������F+������`hF�S|=�i�j�}����<[ʨ��$��"���ڢ2����)�'�X�t偞��=����up~��9�j��8��?ǔ����|;P�va�S��?}�xY�r'\�ȋ&N���-��$�x0��������O�]��D�����g��ڨz5��6w£�?��?3��_��a�s���n��z���Ϭ�����r-+�_�-��M�����!W*b �1��7��&m^�C�Q�&KIoD��x����P,�{@�#La����)���kR����ȥ6bs=��v�� ���|�Z�C04�H�2"��Q���.�Ɓ��f�i�;� p�� �j��7\\ v�IXxc�ϱ�U�QL߃B�y�8����c�J���[#d��n���wLV��5���ڹ\h,=5�����k��ٞ�1��c�t1���ꌼs�qu��R+�S��m�@�����ׯҷ@�¦3$M�KI�^�a�:��/�$;�sn �c-c8W�x첋K�� ���>�[ju�̙�A�NqǥEP�SNnm���ʳY�w����{�z�� ��n|tK�%�����p�#~խ��M��[@�,|(� 01����b�y���/��d�S�=dH�� ������p��#<-ڢ��1�Ԋ����e�tr�Q�D����e�d�/���A�n�8p徙��PD�Y��H���Tc�p�@:�>/��`� [CQ������Gj��8���$������>�G��0�#�W�~����jNԜu�ӫ/�;c.H���6�;;R`� V^p;c_PM�uҝ60�3��͎D���}v���`bɄwH��_m=i��R�r��YH I�EʴKڣ]Ԟ5נ�X��e�R~����|��v��Je���7��q5T&�@��M_ ��k�&�E<s�́�JLOQ�Q�r���w�����d:�4tcN�T诩&5Whi4��p�c�"On�N7����d�C�����sh� ��GӒ{����B�l4�۷�.2���.����=�Z�~� �Bu�b,o0�c�F���8�b�!9��D�ɰ%�+Ѧ��9/��yɃ�u��jJC%"��t�rGߕb�L���n@��}�h#�?t�6>&�I&��g��\E�����pQ\�Ը뻒I��=�o/H�r�t�O��@6(�����" �|Ip:�Zx��KE���s������-�$_8m��Vٻ�6���D�Rsov��s��ܖM��C�&"J��$7���^�9ಅ�� �(i��E�K��ۭ0���l�W?���� ��͘���v����� �<�s�Hb�?��6-�ή^��~��>'FzG�� �K?�w䡛�z\�r�c`���ց_䛜|���<Q���E��9H��n%A$���A�҃�f��t��B��������������4R��� noJ����>��e�<=�'a��_0��N'<�5" K��k����Cd�x6�X=�������M�xE}�|r&���T�s$]��,k�!�rX%�t��w�d�SZ�U��m�u�gYk���!iR����,d�hB'd/E9,�!U��Uڑ�����yޤ7k\������PQ4~���A����(�r�ܮR�RĿd�}��Ud���k]�B(� dO��#�1�o�(s9/D����'[Zf�$�A�E���ϑ�8k��?�qS�vLaᙣ�QƱ�����Kl֣gs��p4�n7��א��G�1yļZF�0���;"���m(@K�2�;�������J� ��?"�G �r���RϷ��Tl�$ e9ʞiY$P}M�Lz���!$��is���*��m��P(A�_U�`�$��q���Ґ�k�w�u�Ґ=z!��ʎ�EMIt1 4v��+bQB���F������֝�-4�Z��]�,9�8}i<ō z�"�v���~�q��6Z2�)��/�_;��+E���Uݡ}���c���=����ːd��"X��bHYK�qK��2� �� Qeg]~�Ș\'qCVV���'4��j�0��z v�1?^�B��Q`}-���$#H��f��������썵���aD��ё����%9��W&)^h�����2�n߷��j)���ݵ8:�b
Behavioral task
behavioral1
Sample
54aeb0501c28f9e96df3fb0ee06f656ee7a63edf6aeeb67434360cac13c49257.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
54aeb0501c28f9e96df3fb0ee06f656ee7a63edf6aeeb67434360cac13c49257.exe
Resource
win10v2004-20230703-en
General
-
Target
54aeb0501c28f9e96df3fb0ee06f656ee7a63edf6aeeb67434360cac13c49257
-
Size
310KB
-
MD5
521f07253fb60dc55cfbb2ba84d5188f
-
SHA1
1020a16d470306c9b47ffd78d7ba9a7878819e5f
-
SHA256
54aeb0501c28f9e96df3fb0ee06f656ee7a63edf6aeeb67434360cac13c49257
-
SHA512
047a416113b185aa8b163ef2a487f04809f98ed5691cd07a1acafa3b75cb25e82230950eeb716154c2ea3c0f7219cf639544d724b39fa11b7fcfcf798d46c1ef
-
SSDEEP
6144:RPWL8hNVBeHa3UArpfaZenv0xoAK7WDIWcbbLWjUATMxfJ:tWLcNVca3UArpyYnv06AUWUbCIAQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 54aeb0501c28f9e96df3fb0ee06f656ee7a63edf6aeeb67434360cac13c49257
Files
-
54aeb0501c28f9e96df3fb0ee06f656ee7a63edf6aeeb67434360cac13c49257.exe windows x86
6922e02cc4ad88f40062035f479ccd8c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FormatMessageW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
advapi32
GetTokenInformation
ole32
CLSIDFromString
oleaut32
VariantClear
Exports
Exports
Sections
.text Size: - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 285KB - Virtual size: 285KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ