���=�����Rid�V�n�Ś���(�|�J��l��%DX�<��P� h DN��_v��R�l��5��gܨpQ��$ݙ�J�*�2p��B����IrYWm�闡e��%�}Ĥc�e��5�}��]��hU�ۗǜH09�A$<����gu��I9�R���%:}����&���� �v*��`i��:��8q ��z,^�9j��{V�a.����|i�X7nC!��H� �����xwn�:��w�)�R��*M"�"8<k�'�}��V�(.�#P>`��܌ă�D�:��AA�`,э���hd4�Q|��':����݀���E�k�x��f���F�%c��v���i�u�}W����{l�zEߨ*N��_�O˿ \����-��!�A�A��q�TY{N��KM�HK{�aj�7� ����I�E0�����̝{�2�\b��-��x�6xۓ������s��u2��}���1��$;7��gm#�@�$��)]P���p��.)��������-a:���P��4�k}� B%J6Y�ʸ�C9�`��� 3�C<Y]�g�H�v^�0���v|tY���m��$�pGp��WП�-� �;q�?a�'DŽwU+O䐤L��]ޢ�-���~.N����.Ӌi�Zb� Mk�N�yl%gB�2,ҮI�ɧ�U��WѨ����e:S�wM�+N��p�[�]l���ߺ���Մ��E`:B�G|P �<���������0���+� �lx�x���9��\ q '��uG�XHD�a���t5^W&.�A��v�Q[��6��J��[��/^��D|!�E���B>���d.B�=�)Zw��� d�i��&�S�B�%���Cl�[24J�HY����6d���T���U7�~�}��S��8�Yќ�U�z:W����������S��2��Z4��cN¨��C]�h� o�ʫh��)1d��!�Y�N��G�)N��(���;�ed�o$k�U���N�+��E{x�m��Dx�L������7"[�OZo���?ۀ]���@b�H�ׯ3����dkft��P����u���,#�6��[�� j�♵�T�������\��7L3���5!�zr��xK�!�����%`o����Z���Ò9��a=��09oO����S���#�u��5S� 撒�0��t7eY_��b��bc��IJo�<&�J�����Q4�=���c�lU��+�\�dT^S�2"�� � _�6���q{1��w�q���P�4SP�-�����.�g�5>t�g��d��?�f4'- ��Y;��WH��b�5�P��]�ʌyJNV��5���5Z9��f� ��%DG�+3�o��dD,�U�A�M:�r�鄱[���JC��1�����d@9�ŗ-�e40�?N�0 ���8����p3�/��-�YT=B�ud[�#�ܟ����C.(�p�_��I�L3P����V�q�N��:!����'(�5Yqk��ssG�5��N�4�fq�r�w������/��W퓔��V�b^��F�:������[�U��w�B�J2j��"�?�퓕c(����b���������Q������Q����א���g��N*�b-�+-`ɲ�(j��vo�H��Ð�t(�_�11=�\���%���3%y'�k伱?�{[jT��FL�g�����9�Q��RRR�#�79���i��w.m��x��(P]��z��P�6_�~s� ��V�9$���Ҏ��+, ��*�f��j��ة|��piا0�d�sP2]v�U� �h��Z� �B`纈�OW���K;Ao����+�Qn����q�D�W*��N�/]�1LCf��|:��fWU��Ȼ%pR���s2�"Ѥ��ʋm�Tw&�l�n�8g6�%2T2��~��`�=�AaB�c& �랛xm�?��a�ҸܐruJa�Ql��cS��@ji�N#�����'� }�}aU�����㋶UQt0 v̚�g�����[9�j�b�a��'�C|Cf���XG�+zDj�{���}c�(UR�����������Udd*K#��`7�,o�a������О�rx�@e.������O�0�A��u� x1��������_w�81�O�(p1�s���_��qڞ�:>���S#�N���0n`�bGZ���.�aH��^5 ���`��kt/�SPZ%zI�e`O����Xۥ�����4>�*�M������[e2g����Dzו�l�f���J��ޖ*��cI*C#���Ô(�s��M�������zv5�v`��� f����@�<x��۵���p(M�F���Y^m�����`cg���Z`Ds��|�}��8p:�w���K��6� ��)�M����Ȫԙ��b�0<E�u�<G�h�) cQ��1*'�Dg���O����_A���ر��=����c�w�e�4l��z��ѵ������Vb�?�7�8E|���W �N�i�n(O��/Aq��K���^2��2ћR�Rwа*P�h����گ���&����'����۔jp�D��_���bnhҽ���v��U����"�������@��Jq�`�_�2�>��0l�r�!�ǘ�,�� "!�������� Ko[������z3�����|��I8���<S�*{��X�w��S��˾j�4�"���/ƃ��*���S7�y�qpyB�9R/<� f~!7������k�o�ݦ$=:�H���c�W㈎`�/���Ξ5\�)q�t�~������2�xiSR��KT` �{c �D]l4&���ݍl�a��+ ��2�7����QI��O��˚,^�c��ybT����R��I��j�i����T��XX7o%�bU�����;m���M���::���߄4�~�W� _��0���*{(�k�:�Y��O�� �����;<v�ݯܡf?��S��y�*�3��ًvY����o$��)�}�r:���Ir��2��r��kC�����@y�A���1�2l��t��́��?��������t��w��˵Ow�íA�T��b�<�r4f�2�V1��zga��a� ����� ���Fl��������c��
Behavioral task
behavioral1
Sample
4ad68422c03e5ff05eb8781894b1ddac7f8f50484846db02ffb33dc92b50f56f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4ad68422c03e5ff05eb8781894b1ddac7f8f50484846db02ffb33dc92b50f56f.exe
Resource
win10v2004-20230915-en
General
-
Target
4ad68422c03e5ff05eb8781894b1ddac7f8f50484846db02ffb33dc92b50f56f
-
Size
14.7MB
-
MD5
3ae95e2531792ed34404c6719e03795c
-
SHA1
22727569c92e5d8801d21a62d21c6791b1351426
-
SHA256
4ad68422c03e5ff05eb8781894b1ddac7f8f50484846db02ffb33dc92b50f56f
-
SHA512
ac6a09093d444508cba78e6f64bd2a2aa3399aab13f52453a8b531db6bd74b34a9ba69b2cb8bd1aa65787509e2018cc44232ae7bdf1e10c88cd6b579a4d7a5b6
-
SSDEEP
393216:Day1TqmgNmXxz9mhAdNYL2/h8ta/n4GFyysEkn4IEWXk/hFR:Day1HgoXx8WNw2/h8Y/4Gl3liiz
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4ad68422c03e5ff05eb8781894b1ddac7f8f50484846db02ffb33dc92b50f56f
Files
-
4ad68422c03e5ff05eb8781894b1ddac7f8f50484846db02ffb33dc92b50f56f.exe windows:5 windows x86
a5d2e84304abed2ce0d1ecbdfba04e22
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutOpen
ws2_32
socket
aquarius2
?VisitAllCookies@ProxyCookieManager@@QAEPAPAV?$shrewd_ptr@VProxyCookie@@@prime@@XZ
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetMessageTime
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ExcludeClipRect
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
RegQueryValueExA
shell32
ShellExecuteA
ole32
CoTaskMemAlloc
oleaut32
VariantCopy
comctl32
ImageList_GetIcon
oledlg
ord8
wininet
InternetCloseHandle
comdlg32
GetFileTitleA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 23.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 14.7MB - Virtual size: 14.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ