O�������ǔ���+�s�D��Ϋt�yH�Juָ��c(~�N��SM�,���c���������r*N�[�/�e pB�zk���3���A��l0\ �o̻���'��á,s3�7�6Vf����x��� � lؚy��j<���8~�`y�����k:�ޅ?o��Lμ,x��M�g��AO���UR���Tm����)xD����iW��;@:,�w��~ ��G����,�� ���H0�DCT1�=]�!��Oꀼ��4{*y���<QU�jQ�� �um��2'Q�)�֭� ���qq~���G�\<fG�}֏���#��ڠ~��M���)ËA�%��?^��ۖ��� �һ.����%�yY�$5+���1�<����2�E�(U�D-��L�@��Si6�V<��5V ��P�q��o��O��~Ο��4r��_,��o�~��РU,�2ŋ��I�x���S�b\�u���������caB�"4���L�7E��WݭS��/�] ��u*^A���/']6������7F���Z�}�.*I���/N/��b�A��r��NI��jfc�ٜ��e��?�YIS�[�N���۬E+5b�����S�hîG��dߡ`L-�p�#�˧�T�����;F��k�X=�мLw�MEU$��I��g,\�i2�X:��r���z��]�`�� ~~١58�)���ꦆ�g[�����f'�ۚY���C���wU�Xۯ�� RC3���O�Lm��ffj�6��U�c���l�A�6'��p[�"x�~�B �!����A^�Gݥ��G�Jb�Tݫe��~�*�k����A��a�l"ט����an<(�Q��s�Dz���[��Uي�NM����fH�%kv��z`���ܒ��gT\ ��Q���9қ�R�9iF��ؓ:{�8�ck0��Q#��O�:��XmSp�J٫k����?5R7t�����w@�_���@ }'4��0zzD0k�����SGIdV���������%í�w��w<����5l��); -a�i�$��A�k��NJ-Ѧ�j�����ǁ?���ؾ��qc�dz��tHWa֏Y����^�Wzn����P!Hl���W���G�H�S�h�.�:�{8nj�P&�� h�I��(>��2�����U�Q�fN���� �TT��ZSD_]1�������Iu^-2�k-�H�K�XP�e�HC-U�|�b�*���3#eey���k�.��3���L��ɼ!b�z���Kȕa�g��#%O��5��!~�g�v���biԓ��v*ZCiO�ν�+������b_��0ƴ�X}���ҟ��<k��<��Z9+�P� n|�X=�< ��M�Lbm�������ڸM�= P�vF9��;�:��b��o�v���o����&]F�s�ʛf�����cF�[��c&.`����״h�����L��`�)�T�V��jC8��Ѡ��/b\` ��u�M��ԋ���o��o�<��F�;!z�����> A�Dz��@�� -�K�ԳԚR�%óy����+�h�2���s�b���xG�Z���1�� �"�1H!� O��TU�k����)�a����u��P���@`e�F������$Q��LAXR@��? �V����_V�k��:�,`TO��H�0�<���˭���֧J�G}+�l�!�9���;H8;��3$�*�� A��ޤ�<2�¹�9�U� >nA06�1�}��2 ����c~=���Q���� REu���/�.�D ���V�@���)�e�YfF��]�5WHf���?����VW̎=A-�6�\���iyb�t=k�ι��<&c����j<oo�|�����amW0g����Cp,Z�<��e�Q=��B�`�7A"S3���#WE���V���A�܍)�'":����k�2-��g���Ư�U�rb/�����Èh���W�M�+`@9aW���d� c�S�TZl!2� *Ig��#5�4�wC�F�ӗw�<������C/8t�cQ�k�3�K<�+��O_��a��3���y���V��-%K�~"O��N!>�0T�#��3sJ�X]p����#`������!�/Q�7I�����`��/��U��Hx��pw�mX�_jv_}������Q�r~C���b |�m#t渐S�}���7�9�!��k����/��:�2����Um�IP^r4}8xӃ� \���w4G6���0U*�,�r�IL��UjgJ\�QD��[��QL@�G��3?�,��xe֧�`����:�(8簅�{�_ZJ�4��P�K=G`K֞���g� �s@�n�'������T�{�+5��{�f<�*��DV�u�fV�5��W�B��<��LQJ&�ܒ�uq�(��,[y�0B��c��ٶ1��'�"�@�"��q0����b �s��:��W<@���|weZ�Uc��O+Kvw!q��A��D� ҥeM����0������V�h�u���a�s����a9��Q7�+��a����:�����B�S��[�-�#���l��,-sDA��ӵZ �7�=O*)��O�U�E�A�`�8�0���-���+�D,�Q���d���2T$��wE��>o���m+p��1쳽**At�O�U���yE;>*���1�<�/1�����p>IZ," �[�'�/i�(��/� L7�bpL>��}���8+��]�\"K�LwO��^^'-�$܍�c/��e�[v�������U<�-cJ }��9H���Ďg�>��`������Q���������f�_���f�XW�5} ���9~4b�U�H͋��%)��tE�p�=�c�"Ҧ�˼��{�����8p�!rzq�{_B[���|�WS%oM=�z{�J�LȆv\1&���h.?/��!2�h��$%Mߏ|�3UU,�n����\l�D2��� ��F��-�I�# �D��j A�������P,���0��6c��Gߵ���W���r��*�'���B��'��ʗ�=;�T�x�ER���<�!�f�y�$��������v�<�o
Behavioral task
behavioral1
Sample
f5a6a7bba91969e4410ae30125fb0b4a0dde7994e1eddc4017e4195f5b66ca6c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f5a6a7bba91969e4410ae30125fb0b4a0dde7994e1eddc4017e4195f5b66ca6c.exe
Resource
win10v2004-20230915-en
General
-
Target
f5a6a7bba91969e4410ae30125fb0b4a0dde7994e1eddc4017e4195f5b66ca6c
-
Size
5.7MB
-
MD5
230a72af918b9fc559107b701b4e2dc8
-
SHA1
f19375637fa0b06a4c64611e1a789fb435dd60a3
-
SHA256
f5a6a7bba91969e4410ae30125fb0b4a0dde7994e1eddc4017e4195f5b66ca6c
-
SHA512
79e51e46fac5ce22dc3873498b4ea988efe3690512719e542ba5f2e703e5e09699d2660649a62e1f57955199cbe8c457303973c535d467016e815ac8e8af78d7
-
SSDEEP
98304:9Dt327+iI65R5jaVzLyLQeRjFqdIrmwtuyAIW:9Dt32Q65OHyMCiIrmO5
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5a6a7bba91969e4410ae30125fb0b4a0dde7994e1eddc4017e4195f5b66ca6c
Files
-
f5a6a7bba91969e4410ae30125fb0b4a0dde7994e1eddc4017e4195f5b66ca6c.exe windows:5 windows x86
29f98633b0f7c276044e80945b421bd4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
waveOutReset
ws2_32
recvfrom
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetVersionExA
GetVersion
CreateThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
SystemParametersInfoA
gdi32
SetStretchBltMode
winspool.drv
OpenPrinterA
comdlg32
ChooseColorA
advapi32
RegCreateKeyA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
wininet
FindNextUrlCacheEntryA
Exports
Exports
Sections
.text Size: - Virtual size: 816KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ