d�l�e�����S��(����]՝ţʬR�H�.�p0�]�07�����>W+�m��VE�J'.{��"�p*�jQ�� �����D�ԧSGM;�\BN*uz�!��]��0�?�6�zL�D+A�a�[�M�TeM��y����x���U}��n���"��$�1�9�.��}+����s�Cp�2���ݼ�Ò�����N��5��*���6_�lޘQ@�0^�t�A��<��z&דe��^RS�;�c2�8���� �QU`��3�q�c��ƙ& �6Cɦᇷ�L[� ��XL~�� ��K���LWj�f��D7�6kD���5���E��H��ʮ�i"T�퉷��@�@#:��n9��T�`h6r���}m� t��x@��Qd����cCPz�Ĝ�Q@:b �`0|��cQ�nD�r��������&`i�|��/�deo��ZV܌�����4�S��Ɇ��=�5��N3#�@�,´��;Aʀ&���ͩ�E`~;p ❏T��MpEb ����t�1�c2K%�%.��M8�V�A���V_w#��n:z��E��?CKp/� ������0���)���܋��0��9̪;�Dkև+Pov �ˇ�Q��h��kP&^���7��$�PB�����ү*�î�La좨u�q�'��� �����a��Y☜�|i\.s����)���� �/ʿ���p�U�Σ�,�\���lp@|�n .�P��ß!^חa �ǔ�9�~xz;*Xz�1@��?�����ru��-oH�J�M~k#%�l�;Gc�*9����%ݓG]��Hel���Yqm��Q4/t���-���[z4��O��D�lN�X�=�2�%�7h3��s^#�%�^��/�^4���Qƃ���S�P�Td<L��xp���e�iIŻW��k���>�AV-��9�~xE�ї�ؾiʷ��ĐK���;w���q/W��p� �UD@�Y�iW�{?o���|.N��]˦�LɊ�l t�Bޓ�;2� �&]��z�[%�~߱�庳:�ʉ�Q/��ś�.�� ~����.�'�� �r�Ê�.ģ5�j�c˙߇�@��<T��k�u5�`�CR` -�y,�fБ�"0u��V�\,�����A3L�Sq2=#�y-�svٛ~�Tٕ����������2C�>�46Yu�u{��{�~KK]X6k�&$����5�+��}�!��'���S��~?&�!wi�����U�ٰ���n!'g�U&��5�2���1�Ӕ��?��krs5�kP�dZ���Uh�Zj�išU,A�B3o� �.�O2:�0���0����F:%����:+�7l�4�HD �U�n���9�=x/j���C�x?�j��D�ܬ�{,>�/���Sf�c����r��� l�����@����7P��}�P�����7��f*��]�s��S}�h���� &�*� 8�Ui�3L���H�V�Y�t�^��S]�s�㟨��9�(��6�!ڦ�3kČ۱�Z�p�6!��E��y(��n$�imAf��5"�T�#�KA6?A �c0Y�"��A?��3�K�X�F���n�H��knJ^�w��4 �� W�D�L0o��W�z-��Vz�W�zC�Ei,��֎L�e���醼�c���e�|ץ �$v��i:��7��g�h>���ظ=ӯ��d�䌖��|D/�>�#����V|S9Ç�b�4�&+)�<,}ɷv�]{#VG^B�lPf��[j�YY��?6�hdq`�30N�\��S�`E@�Yo+��[���^y;����s�->��I�g6"� ud�s)�8�\#�2x�� #�����Gܧa����k�Ps>~55����BÁ�y���a��B��4�)p����k1C����|��6�g�������(�NFP��� ^ˏ0�����܄6`�"ˋ� zfL��oڣC�����1�Ya�'C�.B��A� ��(���,�Ua�V5і?��p��D[�zA�!h��e����@3�]β�������W�a��?"=�P_��M�m��vJ�D��Z��-�Q��J�{{���T��z��@��}L�Y��I��֘0����?s�V,Wz@�J�<�6�Z�<0;=�}p���\��Y����]�����Mf��˿����-�AB*G��Ғ��]�*#��s�ٕ��6j�*�5���ろG: ���<sz�������04�N�jy�f�j��U"��;����f����84O<������F�|4|~�ڠ~�B*U�Lo�'D����$ՙ�<w�<��.�R�FT����!ӻ�D����U]7���_�|+h�>��S'yW����i;���Z�]�iӞ�v�����[V:' خw�D4pB���?R���akq;��;R�rq��E8���S�E-p��F�to�x��R�D�Z�Ze�Dv�ժ�ߧB����@F��Kⲷv�b uR�c�4k����g�P����me��n�\R|'�WiFߋ��h��_!�L� ����,$ؖ!B��'�zn�yX�ˆ]�/P1EZΝ��C�b�ř1�j��1rڨ��e����Ef4y�'š>N#��:��M-����@�t�J���N��s\���|�i���<zXS��v����1��r5J B'��||�#��*�)�?�R�t놼o���F�ȭ�����sb�;�n\�>E+�f�B�� �C ��yg�7�$��LeF��?�X��� j���#�ab�:-BwY`':Ҕ��0Uw���(t���ĺ� ~�$�ڡ�p3���6n�4�~j�\މ��.�I�4�yPvݓ��X� ^�B���=g\��7���=���{ȇ��aY;���؝Z;4� �_����[fP#��I�����>W" �Zz�Y�<���s�d��=�8Es<�����#���O�f�X@��ƞS3j���h�0˾V`�cG��/q��[�"�~���il�F<-�� 谒���ϰ�Jw-�ni��T7{aѸҲ��6g�����Ae& �cF�ѓ߿D��䨏Mr�ZD��G���Lc|P/QNweo��'�Y��a%��c�jo
Behavioral task
behavioral1
Sample
8edeace673e6b4448ac4e4d59d9c4d047ea7b1c4ffdd6207f40e6167221a6c49.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
8edeace673e6b4448ac4e4d59d9c4d047ea7b1c4ffdd6207f40e6167221a6c49.exe
Resource
win10v2004-20230915-en
General
-
Target
8edeace673e6b4448ac4e4d59d9c4d047ea7b1c4ffdd6207f40e6167221a6c49
-
Size
264KB
-
MD5
34c2ca5c3f2c8da9b63497f7ba29f85a
-
SHA1
5bf09848caa5574adf5942ae194397c6cce368e8
-
SHA256
8edeace673e6b4448ac4e4d59d9c4d047ea7b1c4ffdd6207f40e6167221a6c49
-
SHA512
b93ebb0267a7f84c4dabb23af21f2bbd6d1a7803f263636c6521877a6563111003bf31e0d8a87377deaf8fc205c05b7f8b647836b5d9313555c6b47833466c46
-
SSDEEP
6144:06HId5rP+o3OTonjw4aGZQI6b/AQcB4xGBRRxV8B99P:1HId5T+ba82RWAQci4BRHA
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8edeace673e6b4448ac4e4d59d9c4d047ea7b1c4ffdd6207f40e6167221a6c49
Files
-
8edeace673e6b4448ac4e4d59d9c4d047ea7b1c4ffdd6207f40e6167221a6c49.exe windows:4 windows x86
aa73698e802d36e945cb87680a41689e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaHresultCheck
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaAryMove
__vbaLateIdCall
__vbaStrVarMove
__vbaLenBstr
ord696
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
ord698
__vbaNextEachVar
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
__vbaVarIndexLoadRef
_adj_fprem1
ord518
__vbaRecAnsiToUni
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
ord662
__vbaLenBstrB
__vbaHresultCheckObj
ord665
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
ord666
__vbaAryDestruct
__vbaVarIndexLoadRefLock
ord591
__vbaForEachCollObj
ord593
__vbaExitProc
ord594
__vbaOnError
__vbaObjSet
ord595
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaBoolVar
__vbaStrFixstr
ord520
__vbaRefVarAry
__vbaBoolVarNull
_CIsin
__vbaErase
ord632
__vbaVarCmpGt
__vbaVargVarMove
__vbaNextEachCollObj
ord525
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord528
__vbaStrCmp
ord529
__vbaAryConstruct2
__vbaVarTstEq
__vbaPutOwner3
__vbaPutOwner4
__vbaObjVar
__vbaI2I4
ord561
DllFunctionCall
__vbaVarOr
ord563
__vbaFpUI1
ord564
__vbaRedimPreserve
__vbaLbound
__vbaStrR4
_adj_fpatan
__vbaLateIdCallLd
ord569
__vbaRedim
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
ord601
__vbaUI1I2
_CIsqrt
__vbaVarAnd
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaUI1I4
__vbaExceptHandler
ord711
__vbaPrintFile
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord531
ord716
__vbaFPException
ord532
__vbaInStrVar
ord717
__vbaStrCompVar
__vbaUbound
__vbaStrVarVal
__vbaGetOwner4
__vbaVarCat
ord535
__vbaI2Var
ord537
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord570
__vbaR8Str
__vbaInStr
__vbaVarLateMemCallLdRf
__vbaNew2
__vbaVar2Vec
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
ord681
__vbaI4Str
__vbaVarCmpLt
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord578
ord100
ord579
__vbaVarTstNe
__vbaI4Var
__vbaAryLock
__vbaVarAdd
__vbaStrComp
ord612
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
ord616
__vbaVarLateMemCallLd
__vbaFpI4
__vbaR8IntI2
__vbaLateMemCallLd
ord617
__vbaRecDestructAnsi
_CIatan
__vbaAryCopy
__vbaCastObj
__vbaStrMove
__vbaForEachVar
ord619
_allmul
__vbaLateIdSt
_CItan
ord546
__vbaUI1Var
__vbaAryUnlock
__vbaFPInt
_CIexp
__vbaI4ErrVar
ord580
__vbaFreeStr
__vbaFreeObj
ord581
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 228KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE