��'������Ii̭��Ey���c�Q��6M<[��!y�!�z&��M�P�r�¾z\��Uf����\���zI��]�%q�.�Z0ի0L������U;�% ��H<B��j��Y͉�۾��`��\P��rIp��k^]T5�J��3�M���,����ʬ�q�mi;T.a���B��<$Z�)�*��- QetHsmb������}<�������;�� ���*����z��^��Q����Ja��囘��^P�-X�>:17$�}� �\'���b�V�����ڭ̾QtlX�0��c�my&����.����0Ѫ�5e� p_'���s� ��[�$�Ӷ�[���,�Ȳ�eu�o1�'�8KV�I<Ɖ�z@���r��=O�x�2�C�|�Y�fKa�n�b�.�W�P�3��c�r���m���}3��5~��1i�c����������z����FX<�O ʷ��nÄT=��^��X�-�T ߇��ڕ�b��azfIJ@?ܹv��ͨ0c;�z ��Q�5�R�)~ۄ�=�-Y}��+�S͍�)v�K�W5������fi3���xx�V" �� 4�'$��>���V���w% �H �+�ұ�o���8�F�ô���p%(��O|k�����%,ǟ��d�6%��/��Ac�rL�g/\f��]oK7�(����M��M�2S9�厔��f�u�qV���8<?���r��]a���}g/������M�ִ�{3�2l�NO�'%��wJ� ���Aİ�����Z(� �}T�C�T���a%�dw�� ��d��Eo$�W�����4�1g�,%3U1RQj��ߢi��� [���������L� a �ֱ鍅�2����oo�F��#���oQX�ʀ.�X,���M���D�E�Y%Fp%k�h�1ZۅM1'�?�f~�,�6������G#S��{۩w�HЙ �c��we��*���O������VU�+�RP�,����e���'��e�0n��;.���V��vC���u��q�C���Օ����v������-���x��XK�Z��jS�JlX&~q�������C&ّ��r��P5Q"�N�Z{���)�D�c|ٌ��X���v�8#��c���ӯk��fd2Cy��fHz��W�BH8e.���[�P�GFo��3#�f��4eY���H#0�pĿ=���,ܹ�d#�@��o�Hh�����c؈%pA:?& s�@��h|� ���!oH���Y����9L�m���Gࠌ�װa�4�i�.G���?���V�o���u��T[� �[8̈́o���?*��j+�K��_�>p��F�T�kd.p�I��O-Z�#�7��T����������K�r��v$2v� _�q~�:SdҪ��3S�a��5�c^wÈi^)+Ѭ����U�V��]/����_\`=��h)h�kY3���0T��oRP_���Ϝ�4+�[�zX'��OoM�X#�\�ΩF��%{f���8��3;j{� C��x���~b�L������L��+��"��L��s�� 94�VD'Z_����)A���D��N}�1o94��C���:/� S�-M#v�\k�?�T�"㎡!�� G���`��@������6�ێ����lJ�h������hp�G��,��I���oW8����1�7�o��B&h�v���2��D �&����*�ru�.��\c�s����3�VoNe9�`���c��3��9��<��563S���jK���N���;%�}߁M�ř�C���G��S{�>�ma9Lcڡ�/�h���|z�ўS�IYyr�����1�b� )��H*���<ƃ ��1�Z�,�9����]~�eAg7���������?���� 2rF�Lџ����q�Q�j�BԭY0��͏�?�����<ZV���Ps[b���gKܾئ������h�7�,.������+$���������&�k�&�QA���2҃�,^X�<L�U��tj���vd�K���r�ڣ!�m�d�E����=Ap������ #\�8PĂy���H]�� ���)�A�_|��!l)���h�(�������x�8��#�:��i����P=lSo/�.�{ş�ح�̬�s���*4���N�6:E�������0��� *�|���K՛��e�J�O�8B��ZK���Ӏ�H��Ud�[�8ڟ�� � w�������\B9��hPG3����#1m���m���b@�\���W x�f^*��3}��D|\ܖs@-�PU�j�k �3b��0|�=L�7�ĝJ<K L��4]�o�+y|Ĝ ,�;}z̓�jߘ���d#iЋ�Y�����C]ۘ;(x���H�G��U��3����p��r���������ia�g��?�?�l� H�dMۃ���9���������y��%�S�D'�~GWM���p��З�|�/��97��e��F6�&�H�9b٧�������[%l��Q�ܡ��`'��a��ZQ �+"���Q�:B�r7ꤊ1�~��������� ���g{�_E����w�혫,���2�a'xbvB81�w�����Z��������s���+Gnb��i_�^�ZK�=�w$}��<�8���Q��_���o�[�J�gHw����\���&_)ok@����h���(� L���bg�A<��cr��$�w�.�yx��2,b��:�[������5X`�З����iq^�&���\&MU�^���ɔ. ���&�ZX!G3E�c=E��L���Wba�Эo�}�8��M�P ޘ(��>^/VB��9�����T��tB���0�%z�t�4�E�Q;��>lBQ�'y^�ݔb�6J�I��H�ᕋ���^Eg��k}����O{���"���<;��Yf�r��H�|���*5��m�����|i�ݎ$������-�c��s_EmW�:��j>������H'�a������]�%����H�i�h��ӧ��\�oJo����.mM�l��L�+�Ͷ�`�_��b�S ��^d��o�$��<����X�d�Tn�6lD�S=�c���6�D��䮂��A��
Behavioral task
behavioral1
Sample
4665987296918fe9485e8c0f4a6b9ea431623c800980360efc163b6ddea01e15.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4665987296918fe9485e8c0f4a6b9ea431623c800980360efc163b6ddea01e15.exe
Resource
win10v2004-20230831-en
General
-
Target
4665987296918fe9485e8c0f4a6b9ea431623c800980360efc163b6ddea01e15
-
Size
492KB
-
MD5
bb37951c46d07cebb9522741086cda22
-
SHA1
96fecba2db25a47e4df0c5df1e582168774ccd17
-
SHA256
4665987296918fe9485e8c0f4a6b9ea431623c800980360efc163b6ddea01e15
-
SHA512
433c3cfd709f1e5fbf20ba70eb99832679fd4f9c1c84731e45f09236c0c4c5020f8658de2a67e2b73b9a409bbffca363e188f3c0df8c9710350270a23a9c5c81
-
SSDEEP
12288:QDdQB3tbwmoFXE+bAKnWP93rV+T+phQ0Hej09:QDaB3ty1ERKn4pha+pCj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4665987296918fe9485e8c0f4a6b9ea431623c800980360efc163b6ddea01e15
Files
-
4665987296918fe9485e8c0f4a6b9ea431623c800980360efc163b6ddea01e15.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 480KB - Virtual size: 477KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Silvana Size: 144B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE