����K� �>���q�>��"ۘJ*��)��F��1~^0�G� �~��b��c@ W9�h�G�ʱ{�n����44Ą��w��. �4d\�e�6v���c�7�s벓V~x<���JOp �5� �������T�}� �W+Lk8�3pgϊvO B��/��L��J<�p�b��Q�Uh�C�S��$�}�ЇLH��`:�b�j��~�km�)QI�3{)?9n�;LM�d_?�FA�3��؝����c!5����J���7��'1O��8� ��H{̣J�*\�� =�(��?!� �����gh�{�����9"@����I{at����h\ߪ:4�H S���Ϊ�Ջl b���XG�:0���@��(�;�h�y/0��H� L=]�Y�/�Z��E Ǒ'�+��Ŋ\���?+���?s���K9Nt" s���a�h ��I�����8�8�A�Y�;�v�Rg�X��i���N_]*Tn�����RQ����iß=�dwgy��JoH��bR��cY�X2m���j�|5D�T6�[ ��y%AW���p6L�m�+�9!x5�1-�͇h�S��&w�z�Ó��^8�?t*��\��;'a���x����.�t�i���Sq��#p����"kf0��)�O,�uh�v@�T��q~�:Zވ�ې���/X�kw�A��ޥ�㧰V(@[P�j����ZԎ�K��������E틸h_��'31��x/�[`k*a���P��m���E�\�� �mLxب��\�}�{&�hm-&��_ �Z��|4��c��V����PF����nX\��?v�dn�]�� ���)�We��#����;�������;eUMCk���|�n<��j�������'$B� ��H��W��r�X�HOL/JF�s�'aW딁�-�8)������.�í �1�G9�������̒��B� g�,�� ��� �L���Q�1,�Q�����n���^��kl9���R��v���u��%=C��T���<�g|����H:Ę�������W/�X6��z��E�TZF�Ή�Ǜ�?���Zj���6���Ty+b��8W|�%6����b�OS��Z-�~��ɿQ�!��0��&v�r���R=p��d��@��]om8�U�.�������_�4=HS�fD������k�L�DU}��#Zb4/��Yx��xT+ �Ĕ�?��^�Ͷ/U���TVO�v�H�1�#dV�t �/��{,e�p�� �S����}�|�a�ϻ�{�}yS����ߵ����}��i���QN����B/���:���i8m�l(� �g�����(�F���g#+�/pc�/]���y;�o�^,GL�D4ѬP�oc-̒Һ��I����"���?�i�2A5ܞ$�HI"ȿ祻2��X�W���S�u6�v�n�Y;)����$���k�7���.��A���{�mj�YRWb!��وo�0Ȫ��Z�Y8s���Z�0�f#�r))Vӻ o���+�~6��N��� �aH�վ(į�k�6����?��d�2E͢����N��������D���~��g��n|=�>o���w"2�wγݑw��/�M�fck@/��rx���Q�*!�چRΪ�)I��"<qo � �Fz��eN��¢����t({{/�f�:MW-h:� #G*u�I���ص. �FU�B�������E���R���/>坄n�))g�GS�o(Q��w�� �s)�b��LA��g�r������\��k<ؔ�i��cgòHt�H�>1��%�Z�Ϫ��H�*l�b����w۰�#� $��~~.G�6��qu�DzD���B�6赗���p-lZo��˒�d�x��c��e�_l��)H�@(a���Y-��݊��hih��k���|b�ݦ�[|ތ�S�g���>>H�hkR�q��Wͼik �~r3�jv^y���> �Y" ]�)�7e&yUqXc15���Jo=�Z���[掼�I$�_m�0�Mp�QPp�p�8��d*��OT�ʀ��H+��I!In{fwYri���A�|�kē��k�W��麘xA�g>���A] 1̅���>���i�B<-�P;���~cؔ�ˑ�lH��y��:���S�v�J�6 ��?!���ڛ��MB�yu8��=k�ؘ�l��Vt���K@R� hZSR�\8�FB�_�WU(Z����[�\2�O�jj��%q����v$�<Ut�7>��{�`��kR9�8X�(�"P}y�7�N-�xHd܉a-N�&,(��e�����L�5-�� �K���g�B�Mǀ܅�*xX=~�h�fy"{��P)�ʋ{+� �cD��(���̈́�t�a(S�c{�(O�E{�x*��2eQޜ��4<0�r��w���ˏ>�\��4j�0�*-�B�����1ҭ�Fd�kҍdXP�^��hX���O!��,89����K�m>È�n�j8�����DH��8]n_Bk��9j�CY�@eU����PzFʪ��,���?*�"ֿ?U��m�_��ռ&`�3��u~r���P�q#n��$�����c -��( �#��7?Xr�6�Ρ�u�Աd]� W#<Zb/<ՙ��%{��c��d|o���k�8\���˪��8��gI�����HO9��I0x���_�T�Ix�h��sy��EL�,5�V>�х���7���g�������%�`��P?��=��v����kC�����Q �ۼ��zD��$�R�+/ i��C���ԗ� [��P��⌙�9 ��5� ,1I���X\�?H㙣���\�^c64��j&�#|�ƀ�fE#�C��s ���&��8��!��>�n�UiG��n���N����W���+���\����&��[pk�Lj巈hC�������[���$$m��L����y�-������ �|p�;�9>}|������T���)��+(+w��K~������a�K��*3�->%5�/,��o ��V�a w���h��YC��%�M��V�`�0p�|4�{�,��^�i*�]F��^,=���Iw�>��5{?i#+GL���o;���<��k�]&
Behavioral task
behavioral1
Sample
cbdcce198855025f3f5f8196e52856558ab700903f2dc6195a2a1b18ae1098a0.exe
Resource
win7-20230831-en
General
-
Target
cbdcce198855025f3f5f8196e52856558ab700903f2dc6195a2a1b18ae1098a0
-
Size
2.8MB
-
MD5
dc472be18baaaf895a5f3ca4edfb05ca
-
SHA1
bcbd499ab36d020d18b8edb83b06471ecfdd4ff5
-
SHA256
cbdcce198855025f3f5f8196e52856558ab700903f2dc6195a2a1b18ae1098a0
-
SHA512
dce3e17773c8ee311618c8368e280d6528173467387f80ccc812300a7b8a7ecd952e68aca23aba2d816d4a4b3aff76bb88162df2e3a7cc59aad12fb9d7adcbd7
-
SSDEEP
49152:4lccw57zto4AVdrqhixHr61nYtKmcyWVdbZQQ4aXGjwB9DSg:LjAxxLEngKm8VHDo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cbdcce198855025f3f5f8196e52856558ab700903f2dc6195a2a1b18ae1098a0
Files
-
cbdcce198855025f3f5f8196e52856558ab700903f2dc6195a2a1b18ae1098a0.exe windows:5 windows x86
fb65ccb2c7c04b46a85d3d70c8703bdd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ws2_32
WSAStartup
user32
InvalidateRect
ole32
CLSIDFromString
wininet
InternetReadFile
shell32
Shell_NotifyIconW
gdi32
CreateCompatibleDC
gdiplus
GdipCreateFromHWND
atl
ord42
comctl32
ord17
shlwapi
wvnsprintfW
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
winspool.drv
DocumentPropertiesA
oledlg
ord8
oleaut32
SafeArrayAccessData
advapi32
RegCreateKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 501KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 516KB - Virtual size: 513KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE