�%���~�Yp�A��� 2&���������4�9}��^����N��Vo2�\��](@]���=xq�4�0�G��ɵq����������^W> ���Ai.O]ʈ�ȟ�IP��T��)��E���)žyJ_G��oh�u+*%1[����)��n���J4�r�����Ԅ?P�{��刉�W��\;���v�m漽@�6o�`�>�����T[���5H�K��o �ܾ1wg@�B;v��Ĩ��dI�+�����a�����W��Ņ)s���ì}N!^���sG�8E���Ru�e�\3��Ģ����=�;wȜ쩬�6ÑD!�`��킷s���]�Ri��g>!�a�gx�n��i�Q���[/�G��`����X��@:C#lDIL����Ňݿ|�׳��6ߵ�ލ/w1�HG$�K��ɎC��>��?����H�u�Z�;� ��"^(!�S����eۅG+��;��%i��W���n���j?N�PK�_n-��.d/F��ʪ��e��5?�:��2�Ko���p�4����M�q��>X�������r�y��� BSOI_��^@ �Ю��wh���ij�}#�j�ɰ���?LoD�Z s��:�5GA��#H�A<z��#���'�� J���J�~�����������B��0�Qz�O��^�&����Y�4쟄����O�'�� �@uOf�� �y�vʹВ�3NXA���LddWk����y���Wg����Q%��zg\����m��1E�%��#b�'4��x8�Ϋ�EEOw�(H�����ylxR9e��EsY����nK�fSOp��P�0ʣ���?�wN��u�����x������=^ �e=�B�\j����Hh�g�u�խs/xS��}�yCw�<��X������뤕�"�C�=�r��!OZZ�{֪�qa����AGBt������it�AФ��er��Ee^2�r���f`-�D�{#���G. <�������{Tn0��*����h�����2 ��ti�t����b�h�8;%���:>S�ƛ��ir��(D��0�`��l�n��m�x]q�,ӚP+���a*boX�0c�To8��~+]m�Z�����c�`�=Xhp2�Õ�,NI��Շ��;����ʴ�*�VM"��뗂�\�Fq�'�LP��x�as�'579>���'�Q8�t#��D�0'����j�wx��`j�'P���C��r%S�r�A�[4��{�'��ky��)�es�������"�Ν�%���:.q���?v#�@ ���r�蜠���Ȳ$Ѹ��R K�q�cU��lܔ��]=AQ��Y�J;D���g� n��&@�)�H�d�lw��v����h�|�rt��?h&��@.����y����cMc��q�7��\C5*��8��w�����t��-c��hfm���,��]����FE�6�*^ѕ#����^~�R��� J�iz���#`G��y�n*`�q��t�i��\ږYg�2�PS,#�c��}v�����ħ��3y�B��u֗]�)�;�i�Ow� �H��N/fO�F�Ȇn� �w�6��țK�Fpo�&��O� �{ � |}T��@���J�s�(�Jc������#�R�c������.�7� G��h�AP�d��l�� u�����~Q(do��;�m������f�Q!u��˭����a$�7D`���,,�X��4_)�HUL״U��'G_�=^�jb�wIzV��o���]}��B����<�+X2�i�dpj^��U�~_=���ԱR�S�!� �p�V���:��� [I+������/UZ�o��"��Ȳ0�֘!j3Y�2��������T���4�z!��E��j��*C�غs0���|*�*�(��ufkpy��DP�����:��d�,���#)=Z�������;�EØ�DΓloO��-MRֆ��0�E�eM��<8 ���_�W2���2�Q+�h��_���D`��*f�8b����� y��n5�s�|�e�C�*����Y�\�i��\bVǯ���cqt�Z�& �cM�Д�����)�n��L� ,dl��m���0�:���Sha�71as��E*�=�S�����z���q����魊,!^�"��[���]-�O����؏_�����SU'jA&)��1�RO��aB���U3���)�_ �����zU6�;1�F��z��eE{�H�����Hu�g'�,~s��a��K�%�K��8�1B�w[�����)ɡ�ݍ9v�o+v�5;'w�Hˬ��퓻%�|[��֟o0�ۀO:��f��u�B�4����&��)z�KK.�r��R��(C�U�R~� �hJO��9 C�i(SJ���+q ���S߽���BNF~k'D4�����Ī}�]LQBv��� �����w�A[Dk+S��ۤLBv*����x�J9�Mi}�w��a�20�a�).1_����x���L�9oH�}����xG�f�٦e�L�>�C>����53a6�x {�I���y L��g��dG,V֘��u��%��"�0��?�-��ef�g�<x���:����^ZX&y��g!��@.5�U�+�W�.�T\/�0 ��wu�d]{�P��pk�!�tʸA����C�k\�*�؋���x[�v�j@8��2Cٯ�+$�/v�O�j�9HH�ٓw�3�<���K�*��w����w⇷�ƍI���5HwK�e3!���H��gҘ��(���Bl��*By���U��rL.ſ�/f�0������/I������z9���g�Z�%U�����u�D�Iz5��ݍ��뉵���妹 y�Z����?�"�#�^��xF�.�X��Ɂ���2al�g�S=oP��3��|�/�n��Y���>v�NKQ$��������81�,zI��&��C��)s�B\\�d��_�s��X�ٲa9e:�zU#�,s�`�hO:T���,��~�P8N��6�c�&���q��sc�rv��<G�\jx��$�F���~X�6�ɛ�?�.{�w����=/�����A���p���O H2��}L
Behavioral task
behavioral1
Sample
5cfb6a6fe79f3f77b1038ae42607162bee64147cce3c962503320483b9187ac4.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
5cfb6a6fe79f3f77b1038ae42607162bee64147cce3c962503320483b9187ac4.exe
Resource
win10v2004-20231023-en
General
-
Target
5cfb6a6fe79f3f77b1038ae42607162bee64147cce3c962503320483b9187ac4
-
Size
592KB
-
MD5
0df3ded53fd92eb4e1efc47a2f4b37e2
-
SHA1
96575b951c86055c86bdca9898e21379414817dd
-
SHA256
5cfb6a6fe79f3f77b1038ae42607162bee64147cce3c962503320483b9187ac4
-
SHA512
8299f22f766da3f7c33bd219f220032fe7851ac01fd8735eab288b3e132b7a5abeb608e81f2d9d7dd920cc08f37e81f994ea1d01749ac28f652e24a0a439596d
-
SSDEEP
12288:J6oyreWmzYcrF7u0qaRUWkPR3s38H//y9KqiMML9x7Qy27Yd:Fy6WlcZ79qqJCq38fK95GL9wY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5cfb6a6fe79f3f77b1038ae42607162bee64147cce3c962503320483b9187ac4
Files
-
5cfb6a6fe79f3f77b1038ae42607162bee64147cce3c962503320483b9187ac4.exe windows:4 windows x86
dddac1552f8e9d5116f84cb99b7eb072
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvbvm60
EVENT_SINK_GetIDsOfNames
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
ord695
__vbaLenBstr
__vbaStrVarMove
__vbaLineInputStr
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
ord698
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaNextEachVar
__vbaFreeObjList
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaResume
__vbaStrCat
ord552
__vbaInStrVarB
__vbaLsetFixstr
ord660
__vbaSetSystemError
__vbaRecDestruct
__vbaStrDate
__vbaLenBstrB
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaAryVar
__vbaVarTstLe
Zombie_GetTypeInfo
__vbaAryDestruct
ord591
EVENT_SINK2_Release
__vbaExitProc
ord593
ord594
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
__vbaVarTstLt
__vbaVargVar
_CIsin
ord709
__vbaErase
ord632
ord525
__vbaVarZero
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord527
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaGet3
ord529
__vbaVarTstEq
__vbaAryConstruct2
__vbaPutOwner3
__vbaObjVar
__vbaI2I4
DllFunctionCall
ord563
__vbaVarLateMemSt
ord670
__vbaFpUI1
__vbaCastObjVar
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaVarMul
ord710
__vbaUI1I4
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord712
__vbaPrintFile
ord606
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord716
__vbaFPException
__vbaInStrVar
ord717
ord319
__vbaStrVarVal
__vbaUbound
__vbaGetOwner3
__vbaVarCat
ord535
__vbaDateVar
__vbaI2Var
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
__vbaNew2
ord648
ord570
__vbaVarLateMemCallLdRf
ord571
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
EVENT_SINK2_AddRef
ord681
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaVarAdd
__vbaAryLock
ord320
__vbaStrToAnsi
__vbaVarDup
ord321
__vbaAryVarVarg
__vbaVarCopy
__vbaVarTstGe
ord616
__vbaFpI4
__vbaVarLateMemCallLd
__vbaUnkVar
ord617
__vbaRecDestructAnsi
__vbaVarSetObjAddref
_CIatan
ord618
__vbaStrMove
__vbaAryCopy
__vbaCastObj
__vbaStrVarCopy
ord619
__vbaR8IntI4
__vbaForEachVar
ord650
_allmul
__vbaLateIdSt
_CItan
ord546
__vbaAryUnlock
__vbaFPInt
_CIexp
__vbaI4ErrVar
__vbaFreeStr
__vbaFreeObj
Exports
Exports
Sections
.text Size: - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 580KB - Virtual size: 576KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ