W�-�`�r� ��e���i��1�]1e79>wrH��YW܈g�[�B�,ɿ�L�����$�B�.�[G�Ɯը���=�M��۳����#)ҿ��<Üуik.$�q��^Ζ�k~C��=�����(n�'�S��e�y���3�P�%�T[a��6D�D9������O��O��J���k���|����lOr3���UM�].`+t���`:����@��r��?n� 7x�i���f�z�v!G�z\�S`'�tŇ������fT��>�����%!njL����pC�U���i�=����!Z��Ԃ˾D ���K�>�?���[٢. (�˜��`����4�:p0��(2����J��f3mj p&c� ԟ��`��ƺ���M�Z��"zC_��k}��@�Xv*:�d�s�$�0�IQL��s�!�Q��X*��O9i�0:��e>��r�7����_�غ��1��8����M^g����6&5�}�X�ý�S�?%������tB���ްԘ�X�`���`XA3Eμ�2���{*S����sdBـE������ *��6�0�es�O�QO�������d�^�J%K ����蚢�,�����8 Vq�H?����̪*���qJg�]W_�\n_�V�t�f k���`K$,��M_Q�#���dW���N��z��n��%n�ѡ�馪d��o�,v���^n�K�,a����O�qC�� -Ky���XU�/� HY\���j0J��ǀ �8��U�́-�j��UL���'?�;6̣ ��e-��Dr�X\���w2��_��/%aڜm������c�ڃ����=R��vbƅ�2�L��].�b#��ڜ5Uὑ]Xk?,0i;8�L�?2@7;_\}��P�6�E3�,Tl�-쬷q��|)�Z4�B��W� /V�0xɶg�5�[�f�V.�2�mL������v��"��e罯��4,�$;�l���EFl�b��e{W��OObU�w��IxL�$�x,�8�w�����0��������@մ�;��W�YENN�k^}��p���V>�3ʳ�=M�11X�q)�r>'1��k��Y.K]��?H���W�$����PC;�O^�ф��⎧����=>����`L��i)]2A��t��e<F�;�ς@ѝa좛����I䙧x���6�r����f�G$ԣ9J�>�)Q>��$; ���*�rQ�S�5E�*�fXa� �5����-�ѽ��I�z3����CIb ���=AEq�k7��6��}��eG��� 60�O�t82�<֚�W{��H���!��ܛ?\!�����3F�"��D������}�%�a�Q{q�+!2���DDJI-�ꪥ�⅙��{I:v�=�j�(��� �v�u�X�,B�j��6�#��s� ��l�vMPV�Wந�nn��Ǚ~�Boz}4���C3��Z]����Bd�F�����4.�!Me��ұ���b�VJ<C6�D!�$�G7U*���bfeo���c��/�t���ŻkR}MM 6���(�� al ���Ե>���'�v��%o���M��]��M�~�qt�m+z��h�\P���8,'����S������5�&n�M�ȏE���ʃH��I� 8?��]خ����;m�}t�!8ln�Rj�%qd�罖��Dg�S @з�s����b�� ��b3)�56���M�Y��m\׆IBMZ5�Iz_(�בΧ7p�Z%�a�@=�%����>�"���ȩ�d�b|��H^U��2�}�#�* }� �vB��\�7����[�}���}�m�G1ϊY�'��ۘs´��<ķ�3��C�&�J��iQ��0�Ø�W���fBh���yH���G�aY7)L�u/�f�|�Cf����{놸�\*>��Ȏ -�Gz�yJI�����G�T�� �� �p,�hд[�rw*��\ G� (�d��V����h-���_�t�$Q�V8w_��91Ow�������2���ȸ���%���T�����[{��a�m�<)ɇ �}���\ s\�,�a�F<Az��d�@��'�!UW`���I��WD�+�w��������?�Qc�3�h �Q��5B,v}� H�r����V� m�<wO���v! Sy��z�r�e��D�Z'��B�_�M/�躉�����/�a���F*~j���"I5�\�S/����.�X�<2O�����u��kɠ�$�ڕ����|\��Ci}�N��'m�y����)���+�)N�G�dXe/�t���vS�D�����#�Ȕ&�e�O���=���P��$Ҧ���'�O���%^,���F�G�����w�L�yp9O}(;�/ �tc〇v���@=���؊u%7��sѽ��>r%�|T���*�ur����%�}.fP_��ZP��;b�$�(��٫0����6@��-k6�-��u_�?�tƃ��C�-n��w�M���2�,g��>�@.Q�z����u����g�w|� .���k�r�ؒ ��n0�>�˄_�:�Ə���z�~oa����,��՞ `�<zW-'�v+~ы+e������ �%ߟ�<�b�E?���+�d������#��Bc���]>n�q�r��ژ�)B�X|����ջW�@�gc,V�v7��ZOH���"9g-5��\�%���(X���˖hp�`�&����5��O�L��Hq.��6$�ďg!-6�E�_�����=h��.2/Q��c�if��9��?02k�I���?��F�J���f'p߰�x֭Yx\6{�շa�.�rB�l0���yP;!��Df욃�2�I(�;��ٺ��h�P���b���%,@������,��l_g�f���3u�vX�A,�����S��$⣵��?= �b��}��U�x|*��8�:�d�7����!����k�B_�iTX ���ʼyo�����u�C�j)��ؑ~�K=��ŋ�ؑ"��)�{f"�4C$^�����0r�rSR�|�����?.�BIiP�B]�� ]d�SKb�<Q��ғaXJD� ina�-/���Q�\�n�'��H5*櫰�T�����յ����
Behavioral task
behavioral1
Sample
335ed91a393595d366585a4eedd7910a25648a0d46dd3b82258b9bfb02663ad3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
335ed91a393595d366585a4eedd7910a25648a0d46dd3b82258b9bfb02663ad3.exe
Resource
win10v2004-20230915-en
General
-
Target
335ed91a393595d366585a4eedd7910a25648a0d46dd3b82258b9bfb02663ad3
-
Size
4.9MB
-
MD5
155f007c70b49260d91885a576b74b21
-
SHA1
9e7d4daf79693396450423ced39e3e705dcddf4b
-
SHA256
335ed91a393595d366585a4eedd7910a25648a0d46dd3b82258b9bfb02663ad3
-
SHA512
386221f33cfc3fd5e8fdcd3803e3f0ed078cd45175855536d59fb26f9629c4af05a7b594f175435b3fcd5a7cc37b1bf44c44309093045e1c719b9aa09499f00a
-
SSDEEP
98304:QCb+4MjuV0cUtXeIVir5d7JXIDAPfYliCpNNwi0:7f30XzVUPfYliCpNN+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 335ed91a393595d366585a4eedd7910a25648a0d46dd3b82258b9bfb02663ad3
Files
-
335ed91a393595d366585a4eedd7910a25648a0d46dd3b82258b9bfb02663ad3.exe windows:5 windows x86
cc3d79277953e2b221b8e43b3656ff84
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersionExW
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
user32
GetNextDlgGroupItem
CharUpperBuffW
gdi32
CreateRectRgnIndirect
msimg32
TransparentBlt
comdlg32
GetFileTitleW
winspool.drv
ClosePrinter
advapi32
AddAce
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
ShellExecuteW
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionW
oledlg
OleUIBusyW
ole32
CLSIDFromProgID
oleaut32
VariantClear
gdiplus
GdipCreateFromHDC
wininet
InternetReadFile
ws2_32
send
psapi
GetModuleFileNameExW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 592KB - Virtual size: 591KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 559KB - Virtual size: 559KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ