u���`Y�+L��Q��]^��hV tTN��qEb����С(C@��7^�=�P�~�2��/��M*NɅu��`}�XVg���M9�ٵϰ�ĥE'�5o��l�����+�qOr��B���l[)�d:&�)�"�x�"5ǰQM5x��q�Ł��'����_q�U��G���O�?Σ��%�-�����X/�<p����[N���ʽ5����d��X���y`�����6�ٞ��,~��*���盺��1ʶ@��Ȍ�'���"b/�u��x����-�E�`��H�զƚ|������Ƹi�5?��lX���v��S&�B^�⬧� ��궂5s�i�G?}�U�c��F���t��A{���p�C3�s�?/� U�-;�ܐ&0b���"�w�~�K2�b�����Up4�iy�%��A��AF�y�s�P"[΅�=�r>LL��g��5��;�Vob�tu���� Y�,D:��`q����c�� �� �@s�]"?ъ�ñ[��I��0��<5������%�S�Y�ڣ�&zTzG� �jiW��MUy� 0�HS�Nl�N;P¸a���e�m�?n[�$�~u�#A��òh0� � 5�U��s"hE�o ��_�\��^����w���q�l����p���fF�\�f����s��C�d7#����^��"�������<�@�_hd`�d��Sk�!b�;�� ,W;��4y�!�����䃔40�GWGF�={=p��A�Ѓ�(�.��RŹ�����Ლ����?��*)&�LQ�B�ʴ�"���M�fk�؎2�!���"� ��-���B��ă�do����" 0-q,����\��wu+~���� fm�Z���7���JwZ��:�%]J����p��B^�Z�u�ZG�^����o�=[TT��tA��AcɳX4��D�B���7�-�X��5)���T�?����?��`�#Jc���(��!Y�*'�Y�þ�l���� [ ���J_����O����LX'F��Xv��c� iY*g~io痝yuo�vx�1od��SI�хC�T8�d�Y��D/?������a\t�����JK-�u���OE)�MPO�p��W�+] ��{.@���#*):�[�3j��hk�S�\[Y���Ӗ���Z��,����3�Ŗ�bJdF�=�E3� �F"�DVJ�<�Q�j�=9��) ���٘��p�]��>ϟD�HV�]�� Yw�T��HR"�ϡLD�2NЕ2n�)$Vy�+ޔ�jH�����8_��͔��Iǹ����8X����6��w�y^β�[�6��Ga��0�u�uy�Y~��z�B�3n��V�����r�,�P��������,51���s�����B��a��so��@X�պ�Ѐ�fV�_Zd���bξu�#�~�F��� ��I�X�d��r?�B��D�^&�DL� %�L?O�~̛�L���$��aSU���+�����E����淥ޒ魉��S���5<*�H�B��F)�u��_�������?4Du�E���L[�%�r��~�%9��v�5C��m��|���ϾꐸI�ߔ���_��Ż�Fd@�#���,#���g��6��0��4L�\��Y�DKN�?S �s{D ��rU�8pp�Y����$w�R��0-���!��kA�c��Sc����Z��J��C�e�A�0�geKY���KpU�{BöZ�(Ȋ���W�8.�;D�9��7�tI��-B�����o��8m�!�_��ƙu]�U�=#f��o?M%zJ����BH�XF;Z$p�P���k#��ʴ�]ѐM�PZ%��;�=��]H��B�+�C�t N�(�N��wa�,�]��u� K��_��L�o\��,�b+�ī�����Kt��o?��ɨZ¤�[,.�c��2H��������E��\��;�7�k�\[ϭ?���0m=7����}�}??)�?���S�6u ���2(�ʐ�|�p3V�o�����yS�/���.�ͭ��k[J�Q��@��+��� NjF����#�0C�x�c�\ъ�������DV^rR�X���B5Q�)��:?B zP�O2�������(0Q�Q�Mr��ta#���r�LGԠ�[�28Ѽ�IME��'���d�w2�P�u�=�!iy*�!wRWl����G�-]Lw;�w�R�'���:�QxbqX��69���>'�W3��-W]�~t�]=<��e6h�O�d�]��з��s��9�v?<��x���7.��}���C"y-���7J��/I��?!��[a%��$ �z���7�[U��_�t��?���T����WB�%�z3�8���d�� ������M�!7����(r$h�mDu�����sϵ78:`�%�B� \�]b������ҿq�����*�p����H�O'�'9|��t��Љ��PXo/4@|}J�K��`a��2�� �*�e�&C�˸3, ��2�p���S�����[�K��e#?��[u�2�7�tmD{w�x���{X8P=�b/��h*8���)8־�X�R�T�Tx��:Q�vC����e���!ph���3�]P'�8�z����A����9!B�\ՔV�kv�����������y�,���P�T� ������d��ma)rX$��?=��=���ڂ�e-��#�y��>'>[�|���bMoN.���ms3��lX_(�z$H������$�T%���<�H�Mz��\��փ� "���wˋ��<"? �J�Q �}�!4jeE�q6�%�[8p�%��F![� �v�༃�؏�^ևN��ia�2�d�~cp|zv#?�������A ��m����f�b����u5��<W�4V����G�λ�j/-�.���f����]���Co;���Q��1@?���×�B��P{�D/�P�I(�@��fq)z�����#p��L?[�Si�*?����Bd��l�����?��`�� /V`u&�o��|W��n�&����[�<G'��?�5��<��j��;Q)Z.^�v�r{ f��-���P�l���~oh�2X]��Y����'\�`��� �L9��3t�h%Ϗ
Behavioral task
behavioral1
Sample
f422242d47aac5e01bbdfbb5db0da1735b7cb70820a21f8c740a95d0d41284e8.exe
Resource
win7-20231020-en
General
-
Target
f422242d47aac5e01bbdfbb5db0da1735b7cb70820a21f8c740a95d0d41284e8
-
Size
840KB
-
MD5
df073126cc1a49a6f617c421b2411443
-
SHA1
eb4499dee0f068c2153ba7bfdc6f9a1df31915d3
-
SHA256
f422242d47aac5e01bbdfbb5db0da1735b7cb70820a21f8c740a95d0d41284e8
-
SHA512
ddda3a9a4fcc5d003f11dfea91e69414d30cdcc11fa35637ac7b4deffbc519f42812a54acab9767084d08d1876073138eb64be59b2da5a1413aa2ea6abfc459a
-
SSDEEP
24576:x0n0W6Evw14G6Uukw5mR9Kqw1MaN7ADqZ:in0W6r44Cc9w1cDqZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f422242d47aac5e01bbdfbb5db0da1735b7cb70820a21f8c740a95d0d41284e8
Files
-
f422242d47aac5e01bbdfbb5db0da1735b7cb70820a21f8c740a95d0d41284e8.exe windows:4 windows x86
9b805932e747bda063e4ce41fcf9badb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
LoadCursorA
gdi32
CreatePolygonRgn
winmm
waveOutGetNumDevs
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
DragQueryFileA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
WSACleanup
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 804KB - Virtual size: 802KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ