�(���`X�r��U��a�=1�����Ƿtڝd �d&iP^��8ʍ��pw'�/��ba5Q����s~���P��I�Y�襺���&��rJ�a�Y:��qbm���o���u�3�y���g���I?_�cl!�:<�������B�M̋,���!���O�r;Y�)��j�"�9�e��q)@L��5�c4.Y���ȳ�ਁ���3�XzF�Vh��2��A�71���B��}�<ŗ���G+:Bq�P��6l�o�[�{ Hn��D�M8��]+PhH�oq1�����b��t�[���������v����+U���=���ײ���a��{ �wW�&BVeo�\���B�k�`�P���nӞ���'��`�ʇ������y�eoF��2ťC �����*|�����b��!r�0��ɤ��\�ߺ��2)��]! g�|o7c]�苖'�P��AW�+K3jrc���2�SL(�M���VD��+N�C���6���H̒gĐ�xt�P�7 �ކ����� )��6����A�����-��ÄN1 '1�I�{�Gu���1���+B���4zzlSkA �琹�^��u,�<���G�7��z���F6R����3������<AzR��swk��s�<��o-�r�-ԦV�7I� �� ʬ�)QF?�B�#2)�Xc�#{ui�E��X)"��37z�.�ОELw�|�6�� 9�����w96�C��yl�g���Z��98�f�j訹č#���x�e7\���1�J#F��y�_BP��!OU����T�ɥ�嶼mS"�$c̻X�D}~���%{�s��|F��.(|��_�+��tP'����U�n�Y�Pٍ�-@�Rc�A����v3���ܑo�>�oG�{[dGM_g����N���QE}� 7��Ϭ!lrb��L����\��q����&���-�m�j�����Ɏ��>���J�o��\� 9������νr*���s���-������L������fD3�[��f$�oE��E}�ЈŊ�y���ݲ��F�Ԋ;����7���|2� h���H��#3�5����W"͠P���E��!Pu�G!�j��6�Z����/�Ra��ML�g��<��Yi��H��v�O��}��. ��y3r�ʠ�m����d]d��2��{�#M���jΰ 8ұ ���8UU�R7.��a]Sg^��� ppy^[�̧b���]jȪ�LC�]���y��ų5�[��+�!'"������6& � ��5�_�)ɱv>V�cؕ�����s_B#nL��Pt(��������Q�%��-K�i��.���|Ƚ�-�Hȫfۤڹi�ş6+5ҋϹ�v(O�y�~m�Nx�XEbͽ?�&��u8���(��3|�n��͎��/(7Ԓ"�,�;[��|)���b8HIg�*��ˣ���@6���3x��E�A��G��^&l�%7xօcB�4�������m(O�J���H�Pn=��"���\�7�]Ĉx�rr�h�\���Ĝy[J]kR=��[�r����F䳽����8m��2% ;���t�f��o9Z���{[���:'�e> w��֕c�u�� �c[`k��9�������s�$8��59��ۨ� �ľ�[ъʀ�"������L��ﰳ����(e��WC���*���%u��X�!W��F��,����C���>��jyMr�5�i�)fz_Pp�"�$�f?�����{q�pX�b��UY�.����'�0,ս�ŗQ)5a}Ͻ��A܆��]#yv��3+�W���k��yE���6J��᠕3��Ԥk.�$��@����2�BB��yj �@�q�頞��qV�7q@\uL6�� Ҟ�q_TS���-I�_�vj��F!��ٱ�,*�2�r���/��E5x� �B��3 /8������\��glBu��(�ž�B�xy;�y#�� ���8�� f.ժ�W��ёm�vOi aqޕl$���W"^˲��q����ۣ*�q�YC�4�#f�W�=�K���x����yf�g�G��/������R���?#}=j`v%���t�I`Y���6����i볪_d �Toy�]�W��q]SOqdM�9�9: ��i ��x����[���-�0<��K`�����XU�h���{"{�ɌdL�3��b�|��� �?0��C扠D��@23����t��!�F��1�ᰇŚ�9T !䟹b�:7�>��liw?s\� �w��--��>����9 d���Y����L"�piQ����3e[*�x'�&ޕ$M���47�h��9�ѩW��*�_5�i��u��{��a5�������y��*�E��XJXw�1r�M�^�#5r �A��k((����m�s�4YL�oB�z��lb֜b��B���g������6�*Ì�go���z3��ℵӶ�|�ZB;�(��܃"05g]�Ѵ����c]t�����8��jl=YDy����� $�y����,��+�j{���,r��tc�E���� t���Ӊ/���+aC���2�p�����f<�~5==�fw�7Lʥ������ nX$c.O�����7f��`I0͙*(��"��<�R���o^�x*3�v౯�&��[�L� �aci��e�Z��<���ؽ��gsk��oӼ���Wl�b+gqouE�P�!�]s����Q-�g�xhO�d��V/#��l,9��48\~��,ap�}�F���ؗ��ͳ��#[�t���K��#,���K��@\ ��`X�B�Jo�1��QqQ��Q��Z)�[V\�&�,y^@$L�װ�f�xFt���X�{fl>T5ʤ �kV&�?��Y�c������/��+l(�j�f ���#.k�!��u�"-b�酥,N,g ��I����#ZȄ$ל�Z���xu�q'�`?Q�e��F��b�I'��� t+#�����~�~��l�N�����:`��Ѳ����F�+u ��@�G�"p�n�h�!���<���lr���'Ԑ�F�@�w�����w;*�c����!�N� n%%��6��~c�
Behavioral task
behavioral1
Sample
de53a5619723d6c32635856ba2ab623cc220e0eb2893d07a1671315121d8eacb.exe
Resource
win7-20230831-en
General
-
Target
de53a5619723d6c32635856ba2ab623cc220e0eb2893d07a1671315121d8eacb
-
Size
2.9MB
-
MD5
fae0a9935ee9644f68885748c0d9d307
-
SHA1
ad30a22fdacad5899332cdd76e6504cc49fce8d8
-
SHA256
de53a5619723d6c32635856ba2ab623cc220e0eb2893d07a1671315121d8eacb
-
SHA512
6cda97bbab4e7c2b82bd891e80271c6ae8a85875b37cd260ba52e144564736d3d9d147ff86818287a8575cdda8a5a4555c572cf019eb01f7d081aa508d0cafdf
-
SSDEEP
49152:JWBl44CRR1vghRtx0j5x2Y3mI2gQSo97p2Vd1xdDT/PlVgWBy3AHHFPYJ4ACdCnn:JWuRXYhRtGj5x2OmgC7QHxZPgWB/HHFY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de53a5619723d6c32635856ba2ab623cc220e0eb2893d07a1671315121d8eacb
Files
-
de53a5619723d6c32635856ba2ab623cc220e0eb2893d07a1671315121d8eacb.exe windows:5 windows x86
6be9b9831cbcc6b0eb446984e3f5984a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCPInfo
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ws2_32
WSAStartup
user32
SetPropA
ole32
OleRun
wininet
HttpQueryInfoA
shell32
CommandLineToArgvW
gdi32
GetStretchBltMode
gdiplus
GdipDrawPolygon
atl
ord42
comctl32
InitCommonControlsEx
shlwapi
wvnsprintfW
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
oleaut32
VarR8FromBool
Exports
Exports
Sections
.text Size: - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE