'�3�����;�-Y�%�ve<���洐��m�Jq���T�'خ=%n�r>^#O��R@Uw�.T���.I���LL\�;��_G6fЦ�C�mc�9b��Z�.����BJ�wZ��lޢ����*�4=�P�cH�a��| !5���%E척��{�C춷�ۍ�@���|�vG�Ã�h֛�5��v5�I-���%�$41֦��Q�1U�N��=��D����ZR�1h�HO2���zN���O!����ޏ�9 )�!����5�`�6`4��=�}Bp�f�D T$�wZ��6��4&<�t��P�Ĵ����ѠJ�Z����EI�%��� ��%��G�}��i����}�!�_��R`�)�G>9�������c�Dt�]�M#�X=�����dCC�wDer!,��$����O�Xqz�4Ip�o~�������m?S^�*rM�ڴ�aK\g���M�S��D*�e�� �\(�.n����)=�aA�)5��Y�x���d�j�!�&Y�[+���n���z���_C:�*��f��̜˛6���\|�Ⱦ��_�Y��c�yge��e�Sh�xID�#pRӃ#L[���LJ <jA7�e]����۳���C\�|�x��v��vU� 9��g���qn5��1����¥����a��������=M����2�'_c�hҟ�ok�̌��.4���B�����i � �T�0c#2&�p���z}'��4�H��J��Qis�,xG�G=$�����d#�6�n8z����#Ȩ�:�7v\_:��-��Ő� t�P&>�Z�4��-�iꥭw���_��gG����m�hT��{�1|u-��<C��u���h>(F2������s{z�E�,u�2���f�I�)��$��8�������l��{}J�&Ê4~2��k>|�����:G�@�t�.ЍbҍIx��=F��Hɇ1n�\��-+����]���c�c�� I~�, ���`��@j�0 ��g���R��P�,���� +�U������v �H��e+Z�%�7�#�oS�ìplӢ��f9�liC����'3%=��7 |��C�VEL�c/�.Bu#�a#�@*��褈J�탠�>2e�`��_A�G=p!������N:� �ц*���>�&W�S��!�L�NiX���F�O�I�,�N)}G�ك����m�X�i���J�d�������z%���h��U��sF����~N��6R�P6��u�{�pթ��O]w���v�Q���:'��� �W��low�8�k}�s��W�$�j�)���l����+A֔�]-t�Gg��UN�7,/�=�R��5��x�@L9����fTt%ll����q�H�v^����U����;'�T�|!�K1O��+k��b�%KI-ف+�0,K�v�� X6���{]�V8Ȋ��kIX�z�1�}O��`AHQ)a{��}Պ.��̕�����Y�h�mD�:sA4���t-;�Q5P�Ӱ�^�{�����IJ�|�<���� Z0�a�y��Ů�9�������j|#x�Tq��"�3�AܨG}R�|�,���M��-�~�R�}���(��v�46�<d����O��{䟱�iXC&��l���w��HZ�" 5G��j�>h�y��9��������u�~��9w��&�q"H#R�������\X�g9 WNv��X��co9�3x:�����(��Z��51����nZ��`���9Y�{�E$�D���]!����c( �o3�1r�V��1 �?�X��Ċ��c�vtه��6���+��M�*�F_ ���װ�joL�2v^���5���B�W����9�����L�(�b(��D�'}_5��Z|!ӊ�>V܁�1�����A��� %��G��%G{�{5Ŗ��C!h2J'�F�����{§P�_�0�i-�r0_�we:'7�5��x�n=�D���:3���S� n��2���Tԙ@6��D_^���?�<���p�*H2k�|4����CS��Z�hfxx��K� ������5����~���mWY���x�)�*��R;��ѥ��9�NT�Wq�`��M����Ϙ�bF�D��A�����n�z���pd��Ƥ5UV�<� 0t ��O+�=JY�d��� j�\��u���l��dk园�}���%!2����]�:0�s��2��Ǒ��ծ4���^�S�WK�U���(��q2�eu�K�q������횀k��VI���ؓ4��= �)SLת�Ӆ��a��ٶh��@?ҭpdcKW.�/gx�\� ����t|�D���Y5�m�z��Y9�Z*��ٴ���9�v���e{0��'�4Y�����mu{����C���N���į���q���i�S�r� ��n��,c I'�w h��ϧȢ��&���L�ؙ��B��K���.wezo=1�z���^p>>0�l3�p�^���� Ɩ [���p�3����$j<��x �Z���,%�����_B�q�Y5�CI��S ��/a��r�v(^�;!\n �܀S6�'_kޏ�����ԗ�������Wi��U��e��d,!�'�CIw��r>\m���(�a��gC�3��m�2��Æ�nƀH�I�.+��tq]�CP�r]�c���Е4#��k��n�gs�.e5�fB�Ֆ�q����u�n���?)�qK/��{n/����IF`R�&<��'f�j���ˤ#�����:v �W �Q�����l�)}þ]�����n�oB���������W.��/{Op��� �Y� V��!S�����s�%<�䳍0�@"��b��Hx�~K ~��:���q����E=&a���@�+��D�Rk6xN�����F�n�g����75�� ��6'��;<d*;q��ު�R8�ze����5w�8HBN�z��]m�}�4� v��m<~�q�߮�C��/M\���Pv}� 4d��U��B��Χt=��y����.0��ڢ�7'^���i��Z _�i�P�.@y���iýI6�.��f՛�I�f �h��3*C(Ll�^Y����>\�Z��1�3Puv/2��6����t��݉-��=y�mD��V�����<PFS&
Behavioral task
behavioral1
Sample
b2046c51cea289c606e9a31f343ee0bc252c5e21416c730bb9e1e11f5cc12c69.exe
Resource
win7-20230831-en
General
-
Target
b2046c51cea289c606e9a31f343ee0bc252c5e21416c730bb9e1e11f5cc12c69
-
Size
1.6MB
-
MD5
74c5fc46847d6ea7932865a87c70f84d
-
SHA1
b1d69b9fc088dfe06d554ba23b56155ae7f76748
-
SHA256
b2046c51cea289c606e9a31f343ee0bc252c5e21416c730bb9e1e11f5cc12c69
-
SHA512
12eb62d1ec2c105dc9073c213bb5f503bb70ca2b09916d5ba27bbde115bf251ffc41224ba72f39d1cecf6d0dd9aee700393d59803e1772c66027e5305c03c23f
-
SSDEEP
24576:2akKucR3hrhkW4wPcWtokUzYBb2BLmwh8GqUgljf8t73YAZxXfS82qCLVRvCQa2y:7R34Wht1UzwCBLBuG6CXVaRqCLVW2Bn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b2046c51cea289c606e9a31f343ee0bc252c5e21416c730bb9e1e11f5cc12c69
Files
-
b2046c51cea289c606e9a31f343ee0bc252c5e21416c730bb9e1e11f5cc12c69.exe windows:5 windows x86
3854bee7fefdfcdbea4039ef43766a74
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LeaveCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ws2_32
WSAStartup
user32
TrackMouseEvent
ole32
CoCreateInstance
wininet
HttpOpenRequestA
shell32
DragQueryFileW
gdi32
SaveDC
gdiplus
GdipCreateFontFamilyFromName
atl
ord42
comctl32
InitCommonControlsEx
shlwapi
StrTrimW
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
winspool.drv
DocumentPropertiesA
oledlg
ord8
oleaut32
VariantInit
advapi32
RegOpenKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 501KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ