{2�z4���������u8����V>�������Y�]�Ѷ�����e�5�C�䞈��9���n��� B���4����g .�1^0U��P7�~�d���+�"Ä��$,��Y������ŐqS=z�p��,n���C���n���f�'SՉ�x���O�R��v�#�8:v�<�V��p������̃�h����#��s���Kӣ]RRI�)�wl���!o�������Z���Ӗ�s�4��C�+� ��R���r���W(`F wL�|o�w%ʨ�ۓ�?�ۑ�ФJ��[�4�����n ���bw��z�p���r;Y��v��8����^��@*���.��#�AO�s��,)D{��(z���WIU59��8\���c��̦���ߤ�8J�0ڟG�\�;qf�n���y}��l$����\<?+��ƭZ�̱г+���������vOT�t��.�nbo�����+Y�r��T�!�e-=����3$�,N��u %�9�eq.o+]�pR5`x�L+����R1&` #w��kgGL��x�����F ���f<���'l._��s�,gD�F��ۇ�&G2L����]<9�g��f��v���Lh�������T،����L���M%,$_�j���-���l̈�j���N�������fH'�U�Z��p�(3Ղ��9�n��f*0����:^�Y;���1t5�#OX)y�}�2J��fe����E�>�r�� �h����徳dJ����L����Y���)�!��<Z.&�^"Z�4�/�o ��m���&%��~E$�}�Dk��r�oZ�����B����y+��ikb�����EO AKH+F!e�N6�����<��ٻ%.-<����pq,H���^�tG��7��'8�!��M&�V��}�{����0k��=�j�[�N�&�ϱ`�[���^��i2�|iβ��%�+�W���u&�� �P�f���W�g�]�����B�e����[�G�_����^��Hf�,c��7�%�X.�` �U��\.��тy#�����';7���0_]�����$�oVo��vm��Η>R�ɤsO���d�1�y�;���PsK�4�mFo?�ž ��0h�F���uS���{p��z�t9�ז��"*����Z#�HD �A] >����.�m���e�]�u�=�n��Ŏ�IXQ6 f�%J3:3����~q�����g������H�� !�"�C`����q���nM*^�s�ru졁�J��N��AbP��[��N�&Gr%�� �^`M���E>�}�+j^�K�T�K��Fi�Er�C&j��Dɛ��g�vPG#�����=2�� �+86NF��(2���VqD.��W���V9x�b�2��h��.C�/C�3��-i�������0���x`!+���OMM��Υ�J��z�#�\���%&B����q�ɡ?SEqJ�x,t"�i��謓��Y��ݓH-ۨ�t)�%�t*��0ź��xQ�/�ʌ����1��O���\�j�^�s��� �2�N]$Oo���Z^N�c/fB��E�+bu�8S�ȩ�\���]x��^���sݞ ��y�L��K/�1�8 XH�-)�~�mK�Rn��\OM���M���< j�C4�-@,�$h��T~Z�FYی,و�R"*6V�ĘB��������I^3�� �)������D�3���M[C�ta�Zu�=�<�,��`�j R�͇��:� ��� ��6T��W�E��V��,�������2���@X0�Dm��rg�h�/TrYf��$�ͳk��-�|á��7C�w�D�Ё��%��F��Bט�<�lhЇ��q]�u�}�#���X�}p�.9_N1X�݈l��.}:�H�����`�62��"!/�������vT��H��|� Q2��?'��)⡴�$'o��G�N�;�fϑ:�W�¤�n�wJ�#\׀��������Oyͱ>]��oT�Z��oQκn^L%4=&-���>����ig Z���w�S�*Y���f�vGΌ2yI2UX����* ��5���֨'bF;�}�U_ 9���, �o����(�L�������&���j�a�E�S���<�Nm�sֶV��D+��\�Cu��L����n�ŢW_o�mCql�s1�D�T��GV�St�R�7H�� e�����y�E0ʉ�j�1��$����X�v� �]C�Y�� �$����^^�9�T!7 �T���6BR�代�G����hZ/`��6Q�a��չ����Im�߲�0��"��47y ��[�0�5F�R����9E�V̪��M��s���Mw悛� ��:��6�Pإ�,�#� Q�<��@�!:�oݎ��uz��+{�(+EG�E4��Ԭ-�㒢p#{T|nf|�*�;8� �>��[�a���7�� :�sf�(�?��T��r�!D�F�UE�i��6�*tNe��4ǎyK���\^�Iq�R�!N�7�!�.{|y��Ž x�g�"=N�et[�c6��x\닃���iJMop�&R ϋ'�iy�9r���p��:d0��~z���!�����6s��(7ƹ��S`����<7]�3ĒM;&��[ ���go����ӉG��ϖӺsTE��M���}hE���V����� p�?�\(;a5����ޛ�o�~�L���kT�ݦ��0��V��"�8x�w�$�Ǖ��^���g6� �{�M��c ֎'����q��lIY��CSTFc���؈O;LbL�9u�7§�{ #�{��Q�O� P��ʋ��Mw��Q{�|��Ľ7�x��j����GIX��x58�Q[�3��]���b�}&&��:�D�Z����W��JzVE��.��\��~��������\����W��#�GO�~o�$f*��Ϧ5ڡ���|qzt]b�!IEfUϤ���T���-��/;p%$b��l�zh{¸������Q?�a�&�L%k�B���m̫,�2f�s�؉�������Ͻ�\�<�ǐB`�IӼ)m����m7_�i��N�8�9�:7��{���W,d|��UH�^��6�%�r������?�P,�u���+�P
Behavioral task
behavioral1
Sample
4f543954db056df352fc9ba70584c15e24fdcebd88b5e0945b9a5e65fcf21455.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
4f543954db056df352fc9ba70584c15e24fdcebd88b5e0945b9a5e65fcf21455.exe
Resource
win10v2004-20231023-en
General
-
Target
4f543954db056df352fc9ba70584c15e24fdcebd88b5e0945b9a5e65fcf21455
-
Size
4.9MB
-
MD5
0e1485c3313143b7947f2ee864ce8752
-
SHA1
23aff4087f03b9a25ac42d132e852f87f155017e
-
SHA256
4f543954db056df352fc9ba70584c15e24fdcebd88b5e0945b9a5e65fcf21455
-
SHA512
d7b9cf97fa52bf2163920cb5c3324d770db39ba848a6d158892efce29a7e5c2468648841dbec92bd5232948f1f87484810fb2b7a9ed5b3194c603d251a2d1464
-
SSDEEP
98304:rJTZNjzP5GkfrFyjnJXX2G2dxUdqIllOOXxn/jmcGCymyoAu:BXlGkzYJXGG8UdqIzOOBKC/Au
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f543954db056df352fc9ba70584c15e24fdcebd88b5e0945b9a5e65fcf21455
Files
-
4f543954db056df352fc9ba70584c15e24fdcebd88b5e0945b9a5e65fcf21455.exe windows:5 windows x86
a4bd8a32609799e80855e1898f202723
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetVersionExA
GetVersion
GlobalHandle
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostMessageA
gdi32
SetViewportExtEx
gdiplus
GdipSetTextRenderingHint
ole32
OleUninitialize
imm32
ImmSetCompositionWindow
shell32
ShellExecuteA
shlwapi
PathFileExistsA
winmm
midiOutUnprepareHeader
iphlpapi
GetAdaptersInfo
ws2_32
getpeername
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
oleaut32
VariantCopyInd
comctl32
ImageList_GetImageInfo
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 549KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ