&��>O��y3T�4��C�m�I����U]�e7@�f��������q�����aď3�Jρ�L�(\��N,�9e�:}g���4#L����乁���-G��iKvN��]�lԢ���b�:Q6i �f�������dT����YKK���C����sy�_���6���ș:�z����%-)s���.<ɹ�"�0����f�WKp���vU��5E���X�GA|�5`M{�����sқ,9D�����<G�6� 2���Mc��TG�����Jo�{�H+c�U�w�����WWk"�8&)��'㛖:��o$H�:�S.�+�k���P`���W�_^C"���4O��X�ˮ�"$.�44b��>�?22�v���ӌ�>�o���yZ����'�E+UvR�ZV�W��'_�֒�}o֣�ۭ���� R6 �d���Z��;��H� ����ݼ�l�� *a���� W+�{:G� z�ͿK����1��3�¬�P����V�������K�V�2���̒�:���I�7��W~�k���)����n����W��T��t�� �/lW�)沺6Ɗ�z���7��m��T�:������3K���u ?�� ����xdj���9<�7 �!ɟn�t��'nyD&��6(\�.��Z�)b%xu���/��u�$��iq���u�s�K߬`�W�����Aۏ��^' �DV� �M���r-sh�Y_A�*�Q[*H�n��~�����O�mPh%�pT?�� ��b̟;���T"9�`9@��D�9-�J�x���ש�Ī (C���刳�y �j���� �-q�uZ�`�9]�l�Xr�0>w���INp�[Xu�#��KG��au��OT����R�j@�HW�J(��P�V#�<��N������kb�hKV�@d�)82B9�"�Y����=�a�@#Xl�����|t������ ��u���^?|2j%:�!������SE�4L~Դ��:�*�����~����W�4څ������0#�惯��IJ����l7I(��hja?�&��� ͧ6;9������s��).�T�R�mb8/\ॿۉ��Y�Ш����,G<��EJYk�+�,�Q��6��I��F��(I�M�_c� ������)��(4�ndY��^�Y�v���9����0 P Zm��t��}`�� ��Sڼ�ȯ��*z�.v@&z2K�Oi�����������Uy�M� }�� =�����x�$0��?T�a/�x.I��a#��#+����P]�\�F��$����×5��E� �bcw�߳��-i�a���_L��~�`$���u*a�@;Bcks�����S�m.�^��+U�FL��?�0륿;����, Z�/6�/���Irk�#� |B�@�o����C[p�b �p17� �Μ�KG2�c��8^���[��,�J��B�e���w�:�M��*s��@�4��oN�(�� �祙n|%�jzڦn�A�x��!�����VZ�;�E�O��چ�.���=�*�� �L�r�ѣjW@�z�qoC�ķ_�A�:Bj/�W�h�8f�����m��n?Ż=��R��O�a��sr��@�Q�����(V2�����h}O﮷ �q��B6�&U��ۿ�yDQu�ץ�.���8���R�������UP�$�Az.�]Nem������hwn�N�3Pv��KOCY�GE�}O��X0So.0��X�'�t".H|�iE@$���$ �^@U�k�3��wRx�c���^��{a�+V1�j�Z�����N�����<x��)�p�~��vϯ�2�m����sX�KF��56��j���KU}.XG�[�c��ʬ�K�E�bė�.1U�9@1�(cT�������`�����<W���������\*�y�D�s�@l��RI�������������՟`�:Z�j�v��{����e�=�;����a��G`b`��� T����E��)�#��9M��L�z ��O3(���KH��&����_p����|ˡ�R�^�L�F���o�����x�/�{zC8N8�+�%UBKR��b�zz��D�~p20������qa�������'�ԗ/檯?��|�)��Tn���rԹ9��E�=R��+��i�g��@�H�����'�ZE� *{q�}o�f��(1���n��0N�� Nd���?���k��]��SDhU�O��&��S�q�h97Y��4B�DT�z+����꤮N=.��w��YW�)�q ⦐�� �� $~A���֍*?� 4���0����wQBP(i�3�O����Y�fT�=û�D��&fG߹֬���87(���,|�����!�4�(��a�sj(���T�i����Ր�@���x�piH<��:�]�x>'��Ue�2=F?H']<���39lD����*G�y"�ÿ�!%�J!Y���K�� �����/�I;оL1dKFN1�}5)�� � �J,���$�0&v6N�%�G�,��Y|� q���#^Y�15��$�oJב́ {���/�g��#��3�|�B]6��,���3�� K�� �G�+��00�%��d�4�#\\OnO������F���i밫��<;�L���~�`D:W]T4�^+�v߉>H%�|US J����C�҇�V�m8珊Z�gD�� {@ӓ��E��Dx�_��FXWhO�3n^n���s�dU5Ҁi���E(��<㜟�@+������Z5�}�(%>����A$��֒A <O��2� Cm��[8z6g;���k��=�H�N �]Dq����[<�vz�9� �����`*=�u�ڣ�ݞ$_!�����)ft7'?Ӎ '��k�^�/[���DV�:���&����7����Κ��"���o�S5�<ΰZ�8�.�f)�&\�x���d�f��Z ���r�A�"����Rh�)� B�f��'H3`AfW���=zG����]&��ŏ��R6@%�ߒȔ���u�i�BҨ���5��Zo��$i�4���ŵ��{
Behavioral task
behavioral1
Sample
62dd1e16509c29d399a093729a706862150b8644c06cee4b209469f2f9a40b33.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
62dd1e16509c29d399a093729a706862150b8644c06cee4b209469f2f9a40b33.exe
Resource
win10v2004-20230915-en
General
-
Target
62dd1e16509c29d399a093729a706862150b8644c06cee4b209469f2f9a40b33
-
Size
11.0MB
-
MD5
73d9e14aa72021655e6df11a3a9941d2
-
SHA1
5146ab9bb679ffaecb1c3c460e92e2eef92b8009
-
SHA256
62dd1e16509c29d399a093729a706862150b8644c06cee4b209469f2f9a40b33
-
SHA512
1f1245a79cbbae394a2e19d292499f3056cc6096ff6deb6d1c3f086eca7a5fa56e660eceb0ddee1f00a7f2c3fb27694fe0ebc996d4ab6b58d2b7c266269228ce
-
SSDEEP
196608:UdA1S2LxrCh9WL1dhsYbD2L7464SJfjM71QMvHcdBGCihCduVsgYJ1zvneuCJ:QExrlnhsceSSFjM72NdECmCUGggzv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 62dd1e16509c29d399a093729a706862150b8644c06cee4b209469f2f9a40b33
Files
-
62dd1e16509c29d399a093729a706862150b8644c06cee4b209469f2f9a40b33.exe windows:5 windows x86
bba1593a11ebcb30282b5dbc112a52f0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutRestart
ws2_32
ntohl
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ScrollWindowEx
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
RoundRect
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
VariantCopyInd
comctl32
ImageList_GetImageCount
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 378KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 10.9MB - Virtual size: 10.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 112KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ