��y`=���|�g��T �zݫn� �`��2�bq�v�ô�X���u �r���U�a�LHf�g����<;���\�O�A�g0ϰ���iW��p�&�q��3J�,d��:�?�b��9���[}UV-�`�,/İ/_�)�,i���N�Gڎg+?LJu��0�g�����Ǵ�돷�?�5��R������C�E٭��,*�嫤��� )sp3v������jf��t����d�{g�^M�ٿ���Kp���� =@��G٠1��vj���ljD!���gl�=�6v�}��b�wg����K4s�k�Fd����65���ۡ���V���,�XI��$a`4��6ͳb䞨-����4w�hm����h,��<:���!i�B��'��e �%])",�+�t����i�ۘ=!c�++�h�(�{/a���ɚr��CZ\�|F�Ι^��:# L"����'���l[_'��`Y�h,�r��[K�c+������'�*N�ruI<� ������������m�S���DDi��w����p��Rw�����iB�d�X�4���S��]KNHQ��Z��T�U���h#ʼI!�Ra��6��@K�т�z���W3HZ���[���7:��cm7�s��� *�5� ��R7e���x������Ԙ���#4�`{*���),�=��F�J�|1��D�P?|�1��w�>�pd�Ŵ�/غ��yv|.������*.qf�@ΟNT�dfY����DC)��[!�t�a$���a��B��*Ԏ�|��A6Usyu���T�a�[ќ�[ƚ����I�a�����ML,�:�*56�d�8��zEJ�����cv���gڍYdd��۽�t%wY�KC�Ԣ�n_8�/��v���*ltH��p��l��)?`���I��/���1b��� ���ɢ)3�7�qQ����>��㕎�����L0{��k-�eNp�{ok���g2�� ��ٴH~�Rҹ�C ,��^!E�v�q.���#��p.��0ݿ��ÿ9&-'��˔���ΤY��җ@ء��R\��#X!Vw��mHmu��4�E~u��ba7#$o�h� ��qྭ���Z}��6l���\�V-�oH��7$G\?&�@S.���'0Sz2�5�ڜ7���0�. ���� ݰJ�6N<�t�"�����&�����d��̉(���(�` r��`r�bJ�L�%H���r�5hѭGb:=F+��t�/��5h>��tw�8�\����-L<�6�C�a��Z�n�VJ~\�ѹ��5�A� Օ.�gy�p��&���Dl���o9f2�H��E�~����NDv9[AZܔx��4�KL������l��i�>����� �#���Ӎ��nN�dG=�=M����k��ꜗJ>6�F�h �uH%բ�� ����f=��S��&�V���$��@�<�׀nY}*&�ua�z![ *?u��O{|7�^g��.M��U��������'i"ܕ�v����E�u�fQT�;��_�]��(��!B4����:�&�0i��f�x)�i���{p+OM u����B8�}�T�����8������I���d���r4� ���(�E�1>0N�/���E�#���I��;&�ovZϫKc�p���?� j�K��q��Ѯ]��Lw������i3OqB���BN �s�g�P�������4�i^""��S�Bf;i9���F-02>a�����#C��}�i|�eŗ�E�A��N�mY�Ӓ��`�i�:-��lh����M���^LQh���?�,�N����t������c�����%�?Dj~�"���`���_�2)p9f!?�a��Qb�r������de�aK%}+)�^_�iF0�v�6�����rn_4���Qi~]�#�"����M*��`!�8�X� -����J�O'N�&�=��u��g)� ~��[���$1*��B<;�/�� '���\Og��`��ehSܴ�{�)�nٌj*��{�WZ_�h{'3b��qSC��b��# c���ن�k x�2韘�m��bA�9�����c��L���3�/8��ɜ�{�Y��-�_�Z�pO�v�)�&���H�[�l�oT �� �]����.��2��D�;M��g���/}*y��� ��"B�'Dخ3��+��jr���ѷ<�Cg�S����B�uL�*����rQ�]p�!�_i�/.���nL�<p���h�Ń=`AP.ډ���S3sNzD���$Y2�yQ:�/�+nF����=�<�E!����e����:5Hnm+��9��}ښ�<;�~zHs�8az}1(q �S��8�(3�4�3�&VQ�@��:b�c��hV������t^=��F\�����a�����'��,z�{��\q�P�~P�Z(ƆG�AjYpR�K%SH��6���ފ M� �I�m���v�:e�F�ݜ�Oh[yR���B���85P�.תԌ���D���-��t�ǴT3�j�;��������� �t,$ɲ�,�t�l���8�9�&$ȵ�3��q���<���e��G�����I��|R�b�n��u����[�Yr��a���#����%�&p����l��g�>�{�onw��@C@brb������������^B(:\V�r�9ş ����̡B6��7%�t=���Wƴ���W�� }�O7��s9�A�S�~���1���������]�m�5�ɛK�����4����PP?�h�����JENf�]^�L���W� ���Z���� ���.���җlD����)�'��i�`ڷ�<h$��"\_�P�.���l�6��*��Ӷ8D��-�l6��b#�-��B�k�"I��D� �5?��.��N�MD��0�>b��,K�9S�+����6���*U�r� <R,y�h��`�!j��bt�ڪ���E��H��Q�:�E����:[Ws�'Ew��$<!�ȸ�#���"��_C�W�� ��/��z<}��y2{���$I�:����$�S*nh��A�� ��X��?������Iю��w?Z����5� ��l���@N<g�R c0pA��
Behavioral task
behavioral1
Sample
08c5090852e731f593c3ffa2510d51fb50b778b37105eed80c2c6a9435b03578.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
08c5090852e731f593c3ffa2510d51fb50b778b37105eed80c2c6a9435b03578.exe
Resource
win10v2004-20230915-en
General
-
Target
08c5090852e731f593c3ffa2510d51fb50b778b37105eed80c2c6a9435b03578
-
Size
12.0MB
-
MD5
7c5cfe7273710286f89cd167de1c2c3e
-
SHA1
5c3c5c490a974b25349fd3ad013180d1b0fdb470
-
SHA256
08c5090852e731f593c3ffa2510d51fb50b778b37105eed80c2c6a9435b03578
-
SHA512
5df93ff2843ca594d15913c0505fbd766028166f917426d0446c7f528ff0b164970b8881ff517f02b4c46039c9bd131eadeb48efa105b2cb9ce74e22be31d89a
-
SSDEEP
196608:A3y+q5MrrGk8/4HfKbbvdRUDw4lZxSPwES3iPZq97Vn1lJrRQl3PpjpBDwFBG:A3y+qKHHqQlbE8Z97CPVLwFBG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08c5090852e731f593c3ffa2510d51fb50b778b37105eed80c2c6a9435b03578
Files
-
08c5090852e731f593c3ffa2510d51fb50b778b37105eed80c2c6a9435b03578.exe windows:6 windows x86
7532ee233263e677f7b0c2ad58a0a2ab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCapture
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreatePatternBrush
msimg32
AlphaBlend
winspool.drv
OpenPrinterA
advapi32
RegEnumKeyA
shell32
SHGetPathFromIDListA
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionA
uxtheme
IsThemeBackgroundPartiallyTransparent
ole32
CoInitializeEx
oleaut32
LoadTypeLi
oledlg
ord8
gdiplus
GdipCloneImage
ws2_32
WSARecv
iphlpapi
GetAdaptersInfo
winmm
PlaySoundA
msdk
M_Close
oleacc
AccessibleObjectFromWindow
imm32
ImmReleaseContext
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 484KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.9MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ