k��"~I�-.nS�"�[��������ATVH;" z�ѻ�Z'�`���QO;ie �!��\c"������ӵ��Dұ����� �Ā�%dhP��lm��cē#��0�W�fC��LP��ϳD�����g&W��|9T�؇��pb��"$�i�$����$�ؔ�/T*wm���`�M2�n���P���E�#������=_ .�Ju�}�Vd;��KDMXDT�%�����n��K��z�G5~?��tŧ!(p �_��p{��+��?�0q�eN%Ӡ�����D�zj�<e���za�!Jo˂��e�T���z�/Q��/�E@\$�Dh�vl��ANe�x����Z>�9�z��R��]�8,R�[��8O��!��8H�� l�!�:gk�a1ne�����t���C���W��Ƽ �hg��3��ڍA��{\V#����2���J��c��u[ RR�Ka�t��i��k\�j$\)�/��c(8q�w�nVQ�5�]�nPY�_ܟR_�}S��xY�����a�) ѥ�)�]^co��%nP$o��M�mND�Ta�8,"7u�X%�[���M�����Mh-���w&�Pgj�i�O˄P:KK�j�)��ߔ�v��0��2��ä�>6�=/���нv�mA+ah�'uR)�(~Yf2�k��A�.������4\cH�� �c,�o<&����<�ŀ(/J0ȋg�lת%�#v*�-�>�z��1W�vK�_ m�`�3��l�=������(�ic��������ƿ@�B��Y(���I��o/��Q��cGިU���LsS�G�"z��Hf0a�G�Psb�M#]\eN� u?��X��3ƁOǵ�ͨ���"��O8���k���mj�)��(+ W��0ⓤ�f$���8Y�dz�_W�$����2�0[��{̰w��[�*@Ⱥɡ0 V���y4����>g�ow��y��ksɸ�8Ҷv0ؾ&.�eq}@Oi$�g��1�@�*6o�>Ӊ�=eF��S�n��<E[�蛲���d*����i}�f�=6dE���yDڌ?���~r�%��/������?�/�OP���е�Gه2�P���a/ق��F2���A� ��# <ږ/ݙ�2 r;�.�{cW��Y8��s�`�@�fL���zL)k��1�A"�L`�`_|��n�Xv���pF*B��r��i����x̞(�]�H��L�ٰaI ӉżQq�^(F�Ub a����Y�_�����s��t�7!@}�3��*S?� d�78���1EG;�4�7�����=U_Z� ٚ��������y�Մd�����Y,�8t�Қ⾟�k]�3�,�>b}�t�d�UK�{"f��Q�2E$�]+3�w.8 �gi������<��Y��N�e���j�bV�n+;��;�_aBи�*~�� #��|�M|�O�P��������+3��L�'}E&�yUm�t��S,��isu��ɍ�Ɍ��Xiމ$���?�R�S|�J�����'%��L�� q�`��W�7�^(��e~� M�o|��_�=��w�s,@��`G�M�wEJ�SN��{ �l���Xt�������'>Li�C�&��Nƛe#qڧP�m >�b��,�f��]�'� l��J5" �-�K*a��+�;�Ԯ<�Z��d�vuC����MY�e�IT�ck�!"'@sJ}b���ݓ�1^}Tt��(� �M/��kw���À�<Лp��v�(R��S�"��Uߌ2R6�C/�d�Kc�w��b�����az �X�C�\xׁ�ql����ka-���.*�C6��f���.���9�8"NΗ��O�Z�ުL-z�<���������'>��$�ui�h��e�Sg�z��9�ᴿٻ�����Y��k8E��e���Z ���������7���/�#{]�nW�lQFN4�S�k湄�F-Q�L���%֮��մ����,)?���5H� ��ص��6w4����Vv��0\�Mn����t����~��&���,�N�O��0�1놺'@��w�M�=� ��髿����U�7�4�$�2���Sk���Kz��o�!�+��K�?��S�W���Џئu2_A܅'ۏ���Vw�W6��}�]�e��}����p�k��#{��n��K�"��4��+��k��;e0≪S&�w�g6U�\7������ �I��7��\4��i�2�:�s��{R�����%�}S���_6,��r�*t�f:$QCw���e�]�*�ԛ��j����t������&<��_$�Λ�i��7�*Q�Ű^��P��@og-]7r�����Z���L��, #���M�' D�>| ]��Zl3���6]�� �?�^�)Ӭ�M/�1f>{�}ȧ�^����Q��c���֟u�U:ŮfX!w�i�t�S.�^����������j�ܨ7C�a^q�cB��{�w$�θ7CE� ��'Er��GJ� X�g*�f�j��_v=͉p�isX�.S2�|A��~=�@8���3�_J/#��uOb�=t��N��� ]%���Sc �٥O�qB��iS���gzޘ�`��*�r�UH��ȝAa۟&-M�(��20V\ ��V��m�\�$r�+nK�Z���C�?|�K�TZ��A��5Y�v�x7��Ϫ�w2<�L���F~o@vl5�^���Tvt�vr�3�2c^m*��^�3�A\z��i� u|y�K�vPM�i�↼Mx5p����6�K�W����P�(>�7r�R�K�5��d@�,���(�oͶ���. @0� �ʣS���i��l�N��z�?�k8</�@��ןc�Ems�Kew�V�� j���*)B����D������k�)j�"�`�Ow��謢�������Bd�g�������I�uh���Į\b�M<?��Y��^q�>���Kޝ �x�] � TkQ%N:qZ}����!��گhx�k4�r������ �Y��0�,s*�2�N�4m��p�l�a�ٝѣI ��{�O���5˗�P�C�V��-zr����|��&S�j�.-9�Eәr�M5�$�2P���*��G�I8T+4��{�Sh��<6/N�=���Ύ
Behavioral task
behavioral1
Sample
9adb824dc24799e9c0698667c37ea906a5b40860e0acd9089fd3ece91eddbb2d.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
9adb824dc24799e9c0698667c37ea906a5b40860e0acd9089fd3ece91eddbb2d.exe
Resource
win10v2004-20230703-en
General
-
Target
9adb824dc24799e9c0698667c37ea906a5b40860e0acd9089fd3ece91eddbb2d
-
Size
5.8MB
-
MD5
9b205bd4ce4d5453fb3f7965ad86f328
-
SHA1
624e251ee03d0d11c3b809b39e0b91cfcb9a81ee
-
SHA256
9adb824dc24799e9c0698667c37ea906a5b40860e0acd9089fd3ece91eddbb2d
-
SHA512
eca23119d5a9ce9bac597673c93dbdb2b94b513dfd28730292162f0668ff9ae47c40a2dd61ecff027e15af74659329cdc1a28d3a8120178ef75c6850fc2e0b80
-
SSDEEP
98304:t9Lin1mFiLsN47sY71hlyEaJYUjF6NBr3E1AHbFBLFpLZO9gfKkKLpP/WnnKWGB:nWQioNysYHUjYXrAIbFBLfRKLpXXWGB
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9adb824dc24799e9c0698667c37ea906a5b40860e0acd9089fd3ece91eddbb2d
Files
-
9adb824dc24799e9c0698667c37ea906a5b40860e0acd9089fd3ece91eddbb2d.exe windows x86
47c5a13c34fe0ff23d2f6af60ba42536
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadStringA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
Escape
winmm
midiStreamRestart
msimg32
GradientFill
winspool.drv
DocumentPropertiesA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
VariantChangeType
comctl32
ImageList_Draw
ws2_32
WSACleanup
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 418KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.8MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ