r'�b�6��3ūvkoD7�ӱ-�Q�k��7d�����9�}�V�)�矷n��+�%���09���� a}rk+�o]Y�g�|*m�����T<����.Ǹ��m�ċoU�y1-�U���gH 뒴T²��H�)byT��/ �ӆ|SK97J��}� Oh4`�!���D�y2�f�ñ5z�h"-x�8mi%y�a䓩P�ULĽ~� o�oГ6�)ۻ�!��4֣�,�V����#c1�#�95�vN�~<�.�����Ц0Q��#A�xc���&cE��cz��&�H��/��-�݃KbI�L�C��u�!,#]ռW�1��8����S�qپOQ!�\4��uF������ق�2{ڍ���~݅��&���4K�#����{d�H7�W��N(S0��Co��2y�֦:��p�/Jz�R��m��m$]�3_�ĺW�D����Fyk��l:o{nQ���D�*c�9�V{k`̚���%�OQ��;jd�b�gc��@�F�Oߓ�f�j ������'7K`P�[�K��q���;��I� d��\VJ���Y��MmJ�*� ֗/l'm&C�d#��i�w�X|9<5}�8��� l�q�GS����������݂��Z�=!hsj̱�,{Տ����Gٱ���ˤT�� ��}G�U���G�xu�ҡ��@�ei�y�n�Ř̺^�tp����;��3�b�NDw�R!��,0y �b�x�`�8�C�I�[j��E��:�`~�]�ԯ���bg8�'�W�������A&��~��;��2��B?�b�;5R�u��Y7 ܇�w���.�.�<���uJ~��+�����Қ�҅��Ż��EC�=?��I�N���b'b��bv`7���:ۓo'�S��$HR��[s�(~��h�,`�d3H���}�K�ړ�u1u�/��ڴ���d�q �ǒ|]8�;C�xR��L�����W�TR�=��?�i(�t���8Ȩ��a��*��ƍ��g � ܊��츸@Iu�p�Xs`�E����D���>�Z8D)$#�}����Џ����Ep�d �.1�A�>l���9����1��Z���K3I��0������$X����@<%)�6�2����bs cCQ��{�|*3勳��I�CQ,���H.�����"+"3η�� M����6����+�0��MTC]��L���fb�1O3�B.x��x�����"o��$���0dD���`��$����v�x��N��Z>����H��_F���\��A˄��P��ss�����t�<�J}�A^�פv%�f������p�iQ����b�'�e)��!Ts�4t����� e#�!����gĐ4l�2�&:��P��I��s���2�0�͜����|r0��,��5Q=�n�k�M�,�Q��l�^�Cdak0Fq�^�!f����J����P� �o�K�U�+X��,k�N�H��̜ʵ�u���N2�L��ol)���$�/&����j>���m���P�X>�`~H>�t,A�0�����ݾ����*zBq�m���v\?!r���.��@$B�ͱ��XϏ���o��^��.r�K�ɳ\����K���{�y��Y�����^�+e�'�y"����1���:�.S �v�2n3l���e����ض��A��rԁ����r����o��h~��!��./�9S#|�I���"��fV;tпL������ �=�XV����i���G�;Õ4X������Iʱ�G��B��ͻ�pO;���)�F��� $�î^���&���_�S�F�-���th�FS3:6�R����M�T��x]E��6����~TP��1����9�,����K��c�ړ�p]� �$Dk1�4ML]���Fy^��@.ðLS�J1�.�n��ũu1O��>��l5� Cy2����rz�c�h�� ~�>�%�� �==uR ^_R��<F����^8��ݷ �&� ��ܮ���C1Iy�5��zj\��u(��`N�� l����ݢ4�>*��.�:+�匿�YTh�WI������&�y� q �����$��e��D�/�i?��7�k�9Ed���z���uR[V�hhVEk����T��6"U���0�0]5w���y�\���IΖsO��� Þ�F �y��6Մ��կ�4)W/� Z�~֜�)`�7�@:�����x�e(�����w6z�iẂ#�\8�^Y�B��� ������3���\r�JjD��B�͚����1����M[2�1����ytjΓ�x��_fz*],2}�ѕy=P����)��rdDٜ����9c�#�n�V�<76��~EX?^+!_]� @o���2SKIy _Y|�j��o���n��[���aФ"Y~W�k�~��6�G�T�cFg.�D�5�K9�x���� �et�,����y$�kR���qr<xm���yj�@�r>���;�6�dZ� �<;��9�s�6�N8����>#�(@�9Qy��2q1�IS@�bXV�5�)���zz䐒n�<o��[i�.d���<���dG�ArN���������,��e�=�CXc��M�&^9���a���E�T�9��˴s4�z��vJۿ�-�}��V�4���O�-@�������5�H�p,���,f�6��gAd���ˠ���#�䘜���(^E�)�{7l�7���퐪�*n_ʝA���n�bZ��b���&(� v�T���s������+�a3W9i����k�f.�.(;Rö~� �Q�tY]�dn���J:%�_��~�J�]ahr>�V*���J����j_��yXoe�I3����0"��uMQ�iLp}e�"�jX�:�[s���᧵�U���>�ũ�h��`:1-��Sׄ0��q������m�ƄBM+m{�c�jఅa�*X� ]tL�C�|R����\*�u��M3~ԕ�s�;nc�V���;���R������7s�' oʢ(���+;�b�wX�\�b�Ԅ[AJ7q�k�O4<`~TG�\"&D����4�Q�Ρ�p�3�a�H���ڏ�����i�f�s�Ҥ��2�.�x����7w
Behavioral task
behavioral1
Sample
226619857eb4ae35b866da81a6b2f3f019e47258f2976f7ed9d69492cc9a0ad2.exe
Resource
win7-20230831-en
General
-
Target
226619857eb4ae35b866da81a6b2f3f019e47258f2976f7ed9d69492cc9a0ad2
-
Size
12.0MB
-
MD5
01cd77380e883396ac657259c541518e
-
SHA1
f68a9f957a77ed2c8e5b0eb01bbfa40eddfa2a5e
-
SHA256
226619857eb4ae35b866da81a6b2f3f019e47258f2976f7ed9d69492cc9a0ad2
-
SHA512
49906b5b0d206979c24101b92177cec97dbf532162c3d73a04f12b1e4b27e6581ccca341bedd30dc3f40994a8a934f0e698d017442eb4da5f726bd80f529a781
-
SSDEEP
196608:MMbYXudzJ2hROwYOB2wiOehNvb83eWm4pbj7jHlFELt75E3XwrDNPN9:MpAzIYz83eA7jQZ7Y8DNP
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 226619857eb4ae35b866da81a6b2f3f019e47258f2976f7ed9d69492cc9a0ad2
Files
-
226619857eb4ae35b866da81a6b2f3f019e47258f2976f7ed9d69492cc9a0ad2.exe windows:5 windows x86
9bdbac2e77ef0e331ba1babc97adafbf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutUnprepareHeader
ws2_32
ioctlsocket
rasapi32
RasHangUpA
kernel32
GetVersionExA
GetVersion
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CopyAcceleratorTableA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
LineTo
msimg32
GradientFill
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
shell32
SHGetSpecialFolderPathA
ole32
CoGetClassObject
oleaut32
SysAllocStringLen
comctl32
ImageList_GetIcon
oledlg
ord8
wldap32
ord29
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 517KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 12.0MB - Virtual size: 12.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ