Ќ�Džx��U�"�_�E;G���cJ�\Fg��x�}�����x�k,qbg*�x*�S���k�T�J������P����V�z�U,er���~���������w�D�;B����~�(ٟ dKB~٫Z~F�S��/q����`�.�� ��HGau���H80@3�Y2�gu�}=��� 3}�q�w�����RxD�\�-���+=#�>^����X��+�����Յ ��������K�_VT��ߝ�*��`�8"R�d�(����A9��D�g�^O5���~1 fݼ��up�K,9(���I���J���A��A��P�=������ 8w��"�����;�7��<ψ�j��%�B��%�Wڇ[�%�7m.��8��I�.�`��)�7�n����O�4�ڀf~��k���[��X :bx����#d4�:J��m���-�SMړƇ��(c���yP�tR�n� QP�t�}�fs?�խ[/ݲ��.0ן[3ht�_����@��n��Z�|� ��Ʀ;3�(�����"�>�����A���(��p97 ��p�)I������47l��͝:n�@�� ji�����O/�B�ѻ~"�;�wx�Ce�1�jN%o�ur}�^/�A&;��<9D�$��+vu��*j֟��v�v�ī���G�5,�u̔��`J/���ȹ��3O�m�e��.���D��'̴>Hд��֥�mdI>j N��� �i~#�Զ#2���,T�W�K��9� q���gSiz��9�.��#�d�;���E�'�k~��1<c�f����fSCubv�1����[j��P���g�����u�4:~����[q�(+���!����b��ы�76m�R�^�U{Z����^����� Ӭ�Y�mη+�I�P�a�tO~���P�x���zK�(����(g������l��_�`�-'��s)��.����Y���vw�}�0Վ�V㑟#�T���hah'˅a�mr�Ky�v3��I�jn�R-l`�0��z#(ۜ�x<���q)�!����8�Q3¡N,ڸ<S��.�z�H���[��+�Oc���Es�^�Y�=�$.�B�@�����ju����� �%t���ê6����4T���K�&8�xS�f���)������ʸ��<&�D������b9vUR�N昀� �ٞ�N�ԍ�K��ә�S�ڴ�x��j�M�����5j�'��Je4��Θn2yD�R`.l1(�Д�9�PLr��5��]�\�7�O-٫�:�3f�}�+��w�:|����nk�6\M�����!N�)���!md�Ǥ��Z��\�]sdV7�Ez�_X_1������h�T�J��z���R��1[ �%�(gy�� �'��_�k�aƎD '-�F ��1���Z�\�?����h�`�I�x@��$��z��D/���5�����?�_�K�z\i/Z��Rr��$c�Vy���<�(m��8ш_T������r���v�l��k5�&_�ѾW{��W�v)���p? ��8�(4�H�~�_�Y ��t>�%G�儯�^�D�=�Q��T��V��Wy��g."��w�J�T��e�t���%�/{4� ������k����C�Pb�*[�;�͋�Eh�S�~�u3������7�oܒ�~h摼r�).Ts����W����ϙǼ��PDi�4yԉm�ն�`ٺ�)x��<u�%����.2�Q��phk�k��El�H����pѢ���KKGH��Pjf�wf�����-Ƥ�Q-��2SA;��{T���X��I̪�t|�bGF�!F��Lc)ƙ��/�&�zӃ/1a{oU���� �֔���/&Vc �6�Q}�=�wQ���]�����F_9¿g�+��K���R\������W�"d�N��r��P�N���ɇ}�쾙i�C�;�s"Y]Z��H=��u��N������ߵ����Ӆ���-�� cn}�@g继���[�ȯ�n� a�)�Н�C�_y%��{+<`�h� _�����`-�r���#�7����p�^��^���"�cߓ�Ʋ����yb�[y����2�w�C��$��h[HG�f�a�O���-$FIB���]&�+g�ى���$R! O��_�=(�}��L�V��YZ�v$��i|^�W*M�!o��h������d���^�=�Zt� >��H.PI�8�2���(�$J��bg����AX��y�����ϐ�"��;@1+�!k�TP����i!)��8ً+�l�q�����~���a���l���Ί�dgi�/��_�o�30$1 >d���)PX^Z��ӑ�&�x�u�Z�4�/�)U�9�����t��i�s��! PM����J/�IScž�J�,X�#�]n�{�o�r_l3���;N���q��� ��=�`��Y��:������C�u2�vc[�.mo.�Y푓"D�@��g���?�E��ڣJ���%o��C�7��e̢�#hO/���(y{�H([����84������@�������'fI����}�I�ڝ�&�E�� ��*�������A�� ����8,�M�� @���.UӥZ�D���/,ѹ.ڢ�t��?&�oL?h��2��!�h����hn�� �gmD˩\�ĴR������u��k�W�e�oP��׳��\�,��ݴ6�v�nڙ��hKn�PA0�<M�˖,4�~u��ۜ�%���d�3q%��3z�K.hY����H�\���a.���F���oc@L���0A�n�&�IjX�:��t9�Ϧ9L.��.��I�ǚ3$'���*�犽l~I� �<���r��C��'�`AU����*ƀ���<#�@x �*��w����D���9��D>g{RB9+�M,� ��I��Ξ����i���k�f �;uX�>�Lo�|; Ã�#H�D�'��Qu�[>י������6(�4A�r�Mx��sn��3G�FC�0�M�;��91�l���b����dȧP}�t�X�M��`�]~ѼrVpu=�P飄��T-��A�N0�2�Րܶ���6��-Ia���|���&�PuQ�&����J<��
Behavioral task
behavioral1
Sample
445d62812e85e6826adbf4860d2369e0_exe32.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
445d62812e85e6826adbf4860d2369e0_exe32.exe
Resource
win10v2004-20230915-en
General
-
Target
445d62812e85e6826adbf4860d2369e0_exe32.exe
-
Size
4.7MB
-
MD5
445d62812e85e6826adbf4860d2369e0
-
SHA1
229b35e5ea23bfcc196fba3252b06a4063551591
-
SHA256
f4decb7eb9536c59c665d693aca8f809dc38250522b7c833c2f950796ede4c64
-
SHA512
860ea44214b4bdb74a5a6bedc83dc9731d2f8e2c4cab3fe4de991163d2d9aad5597d1ec6ba64b63eb86076b50dc182f33b42a94a223e4b33f4830ec03116a097
-
SSDEEP
98304:snDEwOBBQovLjnNXO8uAN2p93II7/91vtYhtnqtpqr:sn+NPnNXO8uAN2p93j7LvSmqr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 445d62812e85e6826adbf4860d2369e0_exe32.exe
Files
-
445d62812e85e6826adbf4860d2369e0_exe32.exe.exe windows:5 windows x86
61d9cc589c3acbae424bd7a27a0c23e2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetVersion
GetVersionExA
GetVersion
DeleteCriticalSection
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DestroyCursor
advapi32
RegOpenKeyExA
oleaut32
SysFreeString
version
�Ji���S7�%Qy��C�Z
gdi32
SetDIBColorTable
ole32
CoUninitialize
comctl32
ImageList_Write
shell32
SHGetDesktopFolder
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Exports
Exports
Sections
CODE Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 784KB - Virtual size: 784KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 225KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE