x�M��D�d�*Ϣ��_�_���������t���{�Gíd���y�B֏J����yl�?�}��'O��K����&�]_Ć%f�G�부��ӍӴ�7���<z��>Z���j�P��v#������K�p5Z_��_�*X�o��!�Q�@��Be��l2SG�Jӣ�<�s">q��$z��J����?#�]`�V6by� ,�kiX5�G�K�<{NLOlIN��k�h�Z\P���؞f$FvS���M��wO8} {���r�$�6���w�:d���*�@��{~�:8��#Γ/ꩻ��qy��D�;��w8ͣBbH��&u����կ=Ma�E�X���G�����w�U�י2R��{LW��PC����g��(�?�w��^Ȇ<��A� ���:2CP,�� D��e���hY��ʧw%���ͱͱ奻��!=l�X����dU�,�[�x;D�}���,�v�� �ŭ�x���r�yH�DȖ����p�\� @Ǥ���s@�zI���8��l�����n�gm���������k��sv�D� �xS�a7�h��f&6+\ۿ��,fz�R=�u[��>��'.�PL>v�w� ���M|���J��nc��k�G�cH�?�|R���a�{�9�.�ːg�+�͙9���7@mH�f�vZ��6�&����-���ŮG�ƔFoZi�1jV��m� *����/����f��=~�PP{�c���0��?]�3�F�C�v�K�/`T�DB�S�Ȗ=A���gS����VE�{!?{i�lW�D�A�M��U����yVȴ������+ϑq/�T"���b�HO���W�;��>I:�QC��H6���3 /v}@�h7�`FX���h���ܪ�t�P��J���\w�'T�Q�|�Ey8��G���!4-D�O�:a�c�4Y�ۃ��)�i~6�;��*�G�5Z݄�M6�-ZM�"�u~?��ø��C�k�(�'IF����&g�xn���9�K��B3o������)E��MiU�s'Ú��;�ȋ�Q������<�A�J�,�W�n���������R���d����z�N��Kן� �z�m��w�,��f���D����VY"yg�b.9�Շ�#>A4+�X(pt�'��m�pi Q�6�[��K�C�����gtD}�G|Y��oL�s�=HA�~[Oo�7L(�W�疗�\7�ȗڛt�1A9u����� �v�V�H�Tɣ������99���-�L.7��b���FĪ�Щ#H2C} է��S+S\b�®1k#���8���Z M7VǺ�M��S��zi��:���ۯ���{a<}(�C$2O/,|�n�Ș�=N�T�oC���Ĕzȭ.aLg��\��pɉ)�qzo:��u8]��~p���=�?��c��Cܑ�'�Q��T��g�w)ϒ� b0S�{�9~�4r���!ԉ����ot:ש��N�E��B�M��[��"9��{Ҫ�|ʅ�Q��r�mY�:�x� �00�<����&ZK�F,������^�yN�>�=��NjpF3�)���rN��Y\(`@�4�)�.7,�="E�VrH閊@6�wYùh����P�ôIDs]��Ȑ8��ӧ2ى��*5>�\�����Sb(I���*��き���\~4&b���ZXc1�54:�2M`�Ʊ�!!� ��a���1����K�W~pbˣ���g�) ^%�[�?�P��dž��f���������>-�Ġ�?=��J܊W��08�8�8YfF##�\^rB����ٹ�y=���`�X,��C�q�KPy�����$Nq������řᢓ�:q�2�zس�ر���^{�<�p��eķ��5zYC����:%+~0MTg`$���V0{�NC3P?����n�� �_h�>��/K��x�Q� 5�!@E����4kJɺq��S�ʛ%bywh�w ��~`ud.g�D�������[:���0)�oH���b%�cYID9eKm��V�QQ�¤+1Sc����ɬ�n�h�L�s}b�h_a���?%�ԀQ���緵v���I �c���:2��uNOo���c$��'��jw�/�j�g@�J�:�1:8Jd��I9�I���$t��bAZ�J����V+6���� ��J�� ��)ID��p���aj� *�)*������@ )���6*- ���ru��Qv����YQQ��+U�,+3yv�dr���`��E}���0�=H�E��>εq п/TP��4H�H� #��`ܜ������K�ʧ�� x�k'���K{ b��h�Jʨ9z_�I#~U���*����_��P����dw튿GI�_���N�+`�q�an����a]�0C],_�F=���c��z.]��jՃ2��*(��DA����vۈ��U�s����T��$��;d,�(싨7� �k���C���r�f?�[��50=b9���ǯަS b����S��[ZGv�ٮ�Ծ� �c��CdWLi���]Z6���߂��� ���ւ��dء��Ta�//���� c�a��j:�4U%��+(��K]��ӆXbԥ�f)��]��e}Q4x�D$ܚ���QvÞ%�K��L�����,���^"<!��Y�]��C����k��]#�V�֎m�]��A��0�80G-��f��9��@��m h����ǫ������I���A�l�nY�0%�����ˌ��\��HGD�\�Ȉ�NE����(�F@,���U�� C��N��fT���Z���ge�QcH��'~}*�<�����\�y�{�L�_�o8�����b�hͧ.�_���g��^i�O.��k Ss�lL��f�����J�v�L�D�v�����)��o�J���U2n璚������sܙp(�R��3<�z��2�rI�ٜQ��l�l����������`\��t��6�2y� 9�#��+�����즒��Bߨ?eU��&�('RJ���!f����|l~?Oot9sb�z�N�`������N�(�f�*AL�|ow;��-L=퍖O
Behavioral task
behavioral1
Sample
e383cc55fe86e5e50e2a352943bee35c9b434119f0185562fffab1162e733c8b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e383cc55fe86e5e50e2a352943bee35c9b434119f0185562fffab1162e733c8b.exe
Resource
win10v2004-20230915-en
General
-
Target
e383cc55fe86e5e50e2a352943bee35c9b434119f0185562fffab1162e733c8b
-
Size
1.3MB
-
MD5
4723a34d7d2fbaa9dcf3e93536b61179
-
SHA1
53fcb79da02e73b9441389c71a14eb3b55f843d7
-
SHA256
e383cc55fe86e5e50e2a352943bee35c9b434119f0185562fffab1162e733c8b
-
SHA512
58a0c25cded5627321139e2fb0cbbb13bbb8a889d834edaf5f97e6e825daf57daaf687b4a478f162240b26f252e43f6affb0f972eba1a0d70cf8cb9248c59143
-
SSDEEP
24576:IdjsgQM/++dshTB9/EkgPY1qOeb+SBpaO5F+pfTZJpqPT/eCZE:Id/Yd9/jmnJqO5FeDQPiAE
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e383cc55fe86e5e50e2a352943bee35c9b434119f0185562fffab1162e733c8b
Files
-
e383cc55fe86e5e50e2a352943bee35c9b434119f0185562fffab1162e733c8b.exe windows x86
a1566317c91f3e63eed10505f51268d2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord5186
msvcrt
__set_app_type
kernel32
GetEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
RemoveMenu
Exports
Exports
Sections
.text Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 296KB - Virtual size: 296KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 740KB - Virtual size: 737KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 120KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ