�cWM�LО�lsƚ����˱#,S[��'\�CNST��"v�];o| )�� ��ҏ˛�(_`M`h��������]�DZ �k�Y�i6��������Uk3a�9��v�Je���h��2��9��� ࿓�9�=`�),�� �7��aO��gj�Zm��J�n���ð9rz~d\T/3��6�2��'H�G��B����>���3w̤?�x��wэH�����7�N�z)�w����}�)�c1�1-U���`eb ��ĖHk��W =2!�(s&�g�i��Q}��j|�� K�P��O�}�_���%e��q�ɇ�7J>�T����*�� s�p��6�|4�խCq� 9u���yn�dB=�4Xϙ��.����ǽ�_�|���c�T�bp�z�0W.����GFIz|��h`�]a9��w<���A�Kq��,�L�syHC�R�1g2F3�@�n����DܾYN ��?�ج����BuZS����;�G��.���x#���H33@�U+�.Y�Z��F��� ����,X^ ���5S�0� ���v�-�V���b�is���_{!H�)qY4e�>V=l��ɧ�6�C����۳�Ͻ��x�L�ߵ�\��|�w��i{C2p!����PbH3�������- m`��t���\��2�Em���ۡh����+��)Ģ<��c�Z[7q���g�_�&���X�HT ń#O� ���fޗoa��f:ܪ�Hb�GU��e-����;��a1��1�T[�c���P�j�#��:��ĩ4��V�����V~��o#g�NI��#��-����'T�z\�=�k K�-�b[�I2I����؝�.ߥk�"DΦ�~ ��owx�U+�[�p\ ��26& �(�?����qR�%�����b�s5�M��pݚ���`���]W'�r�0�R�C�-B� Z3�����P��IpÎݷ��y����.EIV]OI3B����� ����i�����F��������n��R߷�$Ģ�v�J�O���C���Vi���}(|�k�F$��B�TP��,Ӵ��$k"��ihv�M+���^]�1��.yv蕟�t4��N�If,�+���sm��H�������YH����E��r��k���ruu��&��`Z�N�����nN ���K=%�������N:?XO����6��۵&����Y�)��z�f�{� ���5�{h??j�� �\3P{(��l��UP U��ۿ(z�y�����$����m��[�^p����g���ؤ"��͘�:�^^�"��_np��U��ax���u���8٥S�k7���~E�Y�?��ژ���۷�d��f�-��B)���@H����C��׆������ �}(ק��$���aT���&>v�����,-t�)�5�h��D)�{{�'������c˒�����$�m#�Y[=㧞g��[ENe�~;(�j��%�ZQg�r��}i��GOnjVs�Vh&�.�KI;����T*E�����~[jM4d�Tr6��,�nw��x%U��Ѯc��P�� 5� w[`9qa� ,o��� �L���(XZ&���t>��=�f �`��'/�Ji�_�Y��(���|�Q��!��K���yY\�Ɍ0�2Z�������ޣ�ې��k]�������[��_?>����ltZ?�(n��$�Hj����+Gr��˄��@ߓe��O�S�bn�� �-�/��~N���tu��aܲa��h��!�&!4�BzJ�4+�#Y`���lg�=S����ڟ2d��9NߙQ<���g����<��Zi�������ovHڴcS�saYg4x!��/l@�`Ť�"F�KW=��=������3qg-~I���T��D��P}�V�U��K'"�`2M���v���5��:��!r���p0�0��j��Y�_�'z�}�_q����X,u�2!9w}����8�n�Upv!Ce�����Ic���*��+��q୴DK ����a�H��sP\��pG��:5���� ,f��+Cz�����es,� 4yH^�H�g��f�o��$�E�q��Db���2D=(")*�u�v��AH���9�E���VqzKhl����W���̅��h����ƑO�i&~���ޅn��n�c��/Ҟ��'~�/E�-X�~�������̐ҍ�����ָj�" B���b����x�)ZSld1�j������H#�S��0Q��C���v���[�:��V���=�"�yI��lA|��:W���!גXe�x�Cf0 �T�& �mG��\w��/W�F|[������o�� ���ƕXPJ�]�����&�Ň�RuNo�jZ����m/e4��~�h��VI�-��I؎��Q^͠��/�o`Z��"믜�F���!@�QǦ��0�?�i���g�pst�#�2D�f'{��h��]tPjx��ϩ�� �_3F�P��Ԧ��}Kt]�������좫*Za�Q?�KpY���H[E��\h��B:yLq 0:�W|\bJ�|��NM��;25��j7T�Ӣ[M�|�'���w���j�a����ї������*M�ã����U�֡�G���c"�H+?-�g_��͢v����p��[�T��9r^wד.F��pv�|V�s���v"\x��<��b�fc�����h���^�~*ͮ<�zEFxZ�E���HO���;��Y��\�2�� �pGS�)��.�/�l���W7����Z��K��盍 �X�����iP�"����3;�\i��C�����͢zM�C� �I2�m������æTX�?d����)�GI�Aǯ�8��[�<]��#�n����&�T[)��Yz��M9�[ �B��������"f�4�=8XN.���Xjz���m}� �eƏ�7k ��<ְ���/G���� �0u�j6��#�I\�d�l�S������?S���"���bO�~.�N��5@.�� O1k�Lɻd�R��"6�m��n���0IJV���JK}1���ߘ�����!&�9�֥���5��t�a��2���M$�n��u�8qu�8�h�(W�ȑ괘���k01_ɷ����
Behavioral task
behavioral1
Sample
323b6b24bd70667679c82dc7d93edbf6a7eeda8e3730be571f2e8403758e41ef.exe
Resource
win7-20230831-en
General
-
Target
323b6b24bd70667679c82dc7d93edbf6a7eeda8e3730be571f2e8403758e41ef
-
Size
1.2MB
-
MD5
7374c3d82c794cd7ea7a1a14afa246f0
-
SHA1
8fe3ccfeeb064536018658e23d8137447335280b
-
SHA256
323b6b24bd70667679c82dc7d93edbf6a7eeda8e3730be571f2e8403758e41ef
-
SHA512
40a4d243ee3a37772a234c7d0dfca865a41f645c021db93c52ff2ca9dae1af3606a64d143d28c9e8cf844ea548f21f2fcb6225562a969e454ac0e1eb2e8491cb
-
SSDEEP
24576:gLxK+ppHf+LsOmn4R2ydy/CQI/7Lm+MbQo1ba147V0S0uAXn/zr0eVYnygJ:SxR/+Qnn4YyU/CQe7LPMbNVmhpvFm9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 323b6b24bd70667679c82dc7d93edbf6a7eeda8e3730be571f2e8403758e41ef
Files
-
323b6b24bd70667679c82dc7d93edbf6a7eeda8e3730be571f2e8403758e41ef.exe windows x86
d724c0e7f40ca14c0ee6827c18f4d74e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumResourceTypesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EnableWindow
gdi32
PtVisible
winspool.drv
DocumentPropertiesA
advapi32
RegOpenKeyA
shell32
ShellExecuteA
shlwapi
PathFindExtensionA
oleaut32
VariantChangeType
Exports
Exports
Sections
.text Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 619KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ