��f +;�߁����ƈ4Q{-��Z��4�d�|��$�2��}$�ƒ�Y�1�\��p��ŋ��ڥP���IL���m����E ":��x�~��O�<���O����I0�"%ƺ��ۃ�/����juK�?U�ö����K�ۊ�����Y��y��]��d�0�$�#<;ف�tx�(��i�}R�mji�*D�vS�����F'�Z R�p0�l��jc�����m.�����,�k{�{p6��m虀����컡}|�oX9�An��[gl��bA0Ŵ;L��F��RL���m�i��6Q�ծ��ąg���sl�0K���A������[���-9�����YޫVbmA�T�W_�J=��&�!N��f������B���QV �K2[���C[�h� �k+߅�{ު��)猱�ĮA�*N8:c�.�EA���R�W�%,vҹ=G{�)��$&�-�J�q�����`��?]��<���::JGm��)J��@�I����z;��HA"��O�x�R��G��5�h'������d�L�qc-\_����̬��E�mp�L�Q,/dп����$�����e���>E=џ��X���'<'�f�TfF�Udc*���E�b�q#*E��r�קtثo��=�b�"���d�!��cO]��T�\��� ��A;�=���u3�c�7� �����w�mc��Ý�=�l�G����rjƘ��|���TD��(�V�Q��7��S�mU�= �TW�j1�n�t�����,1��v�����|���a����0Aa��¼ƛydua����Ȭ��Z-�n�����y��'s��J�b)�I,��v!9G�%�ˑ������Y����%?�� *�2�Sc���B�<�0s .��'Ue0)-�^ ������������Ԁ����o�M߅��/Ґ�0e�ba� h�~U�o��"v<�YD9�0�i.y�U��D4����jB '�+J�[oF��a�l�o�Uۏ;�;Ś�qT�y��_���w�N�'��?����g���G����� �K>h�`UB<uK���qf��(�T�oJ[f�p����s>�n�x�J|P$Z�, M�>�<q����69s�vSm#�g�����t�Tv$�`d(��0M=����Uqmm--�Σ�oot���F�d~:&�KDV���?��F]���q�ep�ojkP�F����q� !iG��a��O���/�\�/��#R�1˔^L�D�8.Iou!Ø-�0!�qAE~��ե!��X��[J�Qu'-�]z���Q�eE��PS�B����;,� S���0q��S��En��4���e��[fHĜQ�}@������Wͨ\C�qkt��,�����7}�Ȋ��.�V��� �Vc�J��p�h�{-/A�CHOQ��n"����8b���F��p�����7�R|pz/AM�l(b:�<�&x�ԻZ��y�C_S������p�d��B�w=�U��ƾ`K��R��j�`X� ��G���;]�=r@n��S�A5���,�����:k.s~�%[�K�i���Ԭ��Z��ih+"J��]���C�]�n8����"���?��b9�a j[�sM(��%2�~�$8*Q>g�unXE�$��k�������[�|�u�8u��^6��Pq3��k/MR,�F'^@��ߦ9��ԕO�v������p����ܕ��d|�ݸ����n��\h[�'����o;�������3[ڎ>nxmu�L�����kTW2_�k����ݺ�%V�"��Z�H>�5���mO�����L�9��W�*�U8�`�+-b�����@7P����.aIRԗ;�b��s8/�S���J��{|>/l����� (��N���Y�d��bd��Q��h���Dو�]aD���"��}��VV�p�U�w�5�*)�����8(�|'�u�����UMO���$��~���W�$���Ϲ'�ߪ�O~.�]�źU��퓚*�ͻ�=Q��_d����^C��AN���孾ʴ�Zh�����7�U��wS�Ѵ���2�h�Yl�7��� ���gj�'vj�\Lm'z�/�.P�h^���ib�Uhڶ�֊�z����>��;��G�9�Ⱦ�� �F}py���}��v��|4� ZE�Xc��"�κ贔+�B���Vq��T� ʱ9#��\��ޛO���W'耎Y�Z �`���"6߫��������ݔ�����L�;��d�B'����N�Zݭ�-WB���c�'k��5x������TH�2e���k�����IL+�9�O>���Ϩ�����Ϫa'ۚPЎu�f%���u,�T�CD4�C���V�"����0���m��U�3VVuN*��L�o\��U���R9�X�d�����[P���l��5]2~���.��myO�#>���ԋߙ-���'h^�y}B6��~� �d/I�L ӷ��,�隰ca���8�=�>i���w,�dk�,�ϗ(��*A�ފ �4�vr���.B��y+��*����?Ta=��s�?�ˏJ�~������1�?��V�:��l�k�ք`P��9��6�E,Hv!�N� �:X����������X�BsUZ�D �J� �I�k��a��-r����v���r���/��_�D�j�=�qWp�^����⁊ɥ��b�i��|\��;��jlo�����uB}"GZhǩ�y3���J�Ⱦ�c/�r��G'N`���:^��h�')��:����bҲa ���pw?�kP�o�� s�0����x^FQ@�Q���ධ\��a6��Fz.X��(��B�ǑfL�E�����xe���\L w�Վj��0����e�dIK%��M o��>Y����j���N����F�8Ƃ=�x��=.�����KT�[rʅ���!��:^P"�NV6ą�d>�4���ơ�� �l� շ-̧�~\�kv�μDk_��o��&���&3���.�р�醴�pq�. ��$?����ŋ�Վr��T���<�����������f�|G��u��Il:�7�UzKQlj�\ ��lY�A021� �
Behavioral task
behavioral1
Sample
09864c951340ad57142a75e07bf8584749aca9aae44b941434b9a074aaaee527.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
09864c951340ad57142a75e07bf8584749aca9aae44b941434b9a074aaaee527.exe
Resource
win10v2004-20230915-en
General
-
Target
09864c951340ad57142a75e07bf8584749aca9aae44b941434b9a074aaaee527
-
Size
9.3MB
-
MD5
a2263f3d07fb45042b8944435c15cea7
-
SHA1
dbf114862ead6e6cccc9bd257db5ce86ba96fe37
-
SHA256
09864c951340ad57142a75e07bf8584749aca9aae44b941434b9a074aaaee527
-
SHA512
ea27411e87749739298f36c2ed8bbafc3960fd9a783a654eefbd7fd6f0c71f8c9cfc5d3d7eafd6409917be00b6eff26f4bc5114a90620829b7142d5943d50bf8
-
SSDEEP
196608:ePDfVGV1OCw1dIm2kB5/Hn6x4brdZ7Dvp5wtrxSU70:e5GDOom2kB1n6x2XDLwSs0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09864c951340ad57142a75e07bf8584749aca9aae44b941434b9a074aaaee527
Files
-
09864c951340ad57142a75e07bf8584749aca9aae44b941434b9a074aaaee527.exe windows:6 windows x86
a85e5dd63b2cd6edfe767bdbcf0ef509
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetVersionExA
GetVersion
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageW
CharUpperBuffW
gdi32
SetViewportExtEx
msimg32
TransparentBlt
winspool.drv
OpenPrinterW
advapi32
RegSetValueExW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
SHGetFileInfoW
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameW
uxtheme
GetThemePartSize
ole32
CreateILockBytesOnHGlobal
oleaut32
VariantInit
oledlg
OleUIBusyW
urlmon
URLDownloadToFileW
gdiplus
GdipCreateBitmapFromStream
psapi
GetProcessMemoryInfo
wininet
DeleteUrlCacheEntryW
oleacc
AccessibleObjectFromWindow
imm32
ImmGetContext
winmm
PlaySoundW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.3MB - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ