��#%�^�c��"C���jBO��B("������Č*�M������9EP �VmQ:�Bp�:=:풕���\�c�p�@�� {(�qt�S��q�(X�b�w�O�o�>-�t^��~��lH{�h��ƍ�/P7sRAό�"8�H ���w��.7�����dF�����(��Ufg�\�� ���8$�0��!�XqR[L���o�q6q<���3^���*�h�s��Ҳ���D�S��@�_|e"���1�e�*8��A�#����fqc�kgv��l���wQ�NdM@Hǎ0��ȅ����K,��t�� ���r˵����>B?��P�U0�BBe��K��Q`2��E��.��^��&S>�1�;�>T�2g�#�����X�|al��%�����9w7N����d|T��gB�:�8��%�����G����)�n���0N���"�^������ڔ��R�����8���� �/2[ǿ�m����2t�}��ȑ:��w�<��r�7O�_y���y���"����v�� o\���,�4ς��+9"[�au���A�t�7�܄��ؤ�k�h�ҚQ)�F�g�1�:��y���Z��iLm~��?�݇���~;0J����+��ܝ��[<����a"�\��^�P���RN1a ��2�D���&�����q}�,3��R [qO�&�V�����D_�*-�K�xF�^h`�<ۼ�xЄ��fY����>�_���-h����ڣ�B �����H}��f`�Y��;��ä��O��E �10�{������:�|ĥn�Ќ����������hL����:_)����&@N�?��/�Dsw-Ţ�]ܖ8E��o�HV���^��\�����;;���܉k��wK=FZ��jd��ƏPרa�$,��t[�Ru�3n�;4L��z�P1���(D���M Zb8)���w��X�n�'C��x� (G�NP�ܫ ����%ge���Z��>�h��K� #Yw��rÉ�jH��TB���x�����!���-n����m,��w��}�*݅����<�_�����\I��F�.կ�mpiq��Շ��2w�Eݸ�����DfvФ��|+�"QĞ�<#y^�1� ��٦^ ] 9���}0܉A���l���Q,QB��r++��p��~�*R1~# w���Z���t��LS�߉�F٪K�Y�x�k��,x�n�����/�&|r�T߸`(�_ҥ�$*�M�ve%˚ŝ9-S��p�<���֚��.}��$�c����I�ճ_F��jq< m �8֜�^e�t���J��I��4�ޫ(����z'�P$��l����������7�$����p7@nd������)�8�s*7퐜���̭_��+��H� ���b�[����t4@oA�j��s4y������cA��*�e�F���R=��H�U��rȷ�\�9 ��W�����K���~���nkl�I�z3�����=C�g܃��DJ��լ���V�� U���:�l�*�`&��Fi�J���Oe$A�-}��cG��U�tf2V0-Z���hs sA�D�g�9����:g�����U���<Y~��p��v�M������6���M��r�o���QZ=i�wz�C�Bl��;����v��{���d����t���(�ɫZ�V�-Kk��_��+K�dj�8�i��N��>�v)���V�L<���!Jp����.����{���i�耬V������sV�n�+Ht���h�sW[��Z��6=�n����"T_^��g�R{|���Hl瑾�� � �������2�i�.m�h�Yjth� ;���/���� �l��@!�;@ݠ%N;շ�U��.���|����������ʲ�����ep�4��Un1�����:�' >N8l�<@��%�_�NU�*?EP�������aă�h��V� �r�O^`=�i؆YuI nF<B@�����M�r�k)#L^�K,!��Z�3�i��Ƙb)ЂN���_ߥ� �t����35�=}�l<\Bdл�NS�z�(��ЊN���\Lx2����ƭ4r�;7���?eN���y�䤁4T5Ha��G4WE~�\������hxZYX���M���B���]z��qo��d�m�]��Q=����c�"�W}����$z�9>�Lǜe\����d!?���{��K���^�m�%5����_�2�FW.U��Q�,���q�刬�~�ݕ{���� 8\�b_' ��{��p�V�q�oG�XeZ�$���� R��/��Ԉ�]I�����j���8���+l� ����(P�X�2 vڑ L���͎�^5���nЂ�pQ���(�}4x���� �]5i �*��w�iq��6���r�|��B��v���A��vE55��-��G��+���� ���F��J�ԋ�Pj0j3��&��Tl��G�y����Ri���&�nǗ=��tu���=xT.v�_��B�@�Ad4�::Sr���3�3�08��6+��]ꋡY+d�;嚦�䟅n�h%�v��@R�h&���f��t;�����s�&�m�g��D�;�`�fkj��.<5+�8o5�����i�;g�WW�[5�(�`�h9�В�0�*��&io���]b_��h𰅣�S�akv��� �u��sʥBlLzя�@*���$���9d����̉:���`Qa�Mi���Mp�Ys���J("�J�@��V+0���hF ?ֻw�lH��~۷g�u����Ds�6���aK��b4&�ϑ��. �EHg\Q#�:V/P]�j]o�3%M�j\�z� k3�C�z|s!Q!� c�GY9���W�x�(h�l�2t���3��UD��\ ��ZX��^I��ld�)����&�1$�a�^�����^\��,�%�AuFG��\x|gI�����Z���@"D{FQW��=W��#�ף�� ��j}kt��|�w]DLa�����I����萻i)�ElY'�����Գ6�50����]��u����>wK[E��$u�Q�~���f���ai��M�-���ٵ̚Z
Behavioral task
behavioral1
Sample
5af8d339d19bb8cdbeabf456efa34114717fc109be660ec4024b1c05aac49ac3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5af8d339d19bb8cdbeabf456efa34114717fc109be660ec4024b1c05aac49ac3.exe
Resource
win10v2004-20230831-en
General
-
Target
5af8d339d19bb8cdbeabf456efa34114717fc109be660ec4024b1c05aac49ac3
-
Size
2.0MB
-
MD5
88a5d7550141d73056affb6ff4b1f8c2
-
SHA1
dc722391a1da44226cee6f9aaf2b57e4e499c7a3
-
SHA256
5af8d339d19bb8cdbeabf456efa34114717fc109be660ec4024b1c05aac49ac3
-
SHA512
37a4d8123fd9e231ad0f6bb4f11ca12d9f8f06472bfeb42a2f5d8b7f00261176c664a5692652cbcc841cf93e9b88eee1368313d79135e78014a04f6493274caa
-
SSDEEP
24576:qKXUna/WEbF2YzKPdaFtpR3WSWlHGypjJRbxkArx0rWy3LA1O8cFaeGYrbTYkP3g:LUn3Eb128St8gjxCKg8Z68kPo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5af8d339d19bb8cdbeabf456efa34114717fc109be660ec4024b1c05aac49ac3
Files
-
5af8d339d19bb8cdbeabf456efa34114717fc109be660ec4024b1c05aac49ac3.exe windows x86
5e369034f6c557a315f54fb704dce0ae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryPerformanceCounter
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ