�V��$j6a�0ӭ �V�X�a �܄D(l�f,O�\�%�e��J:���0�8�.���$'ۣ^� W���P����T�ں�G�s�����+2���?}�ՄT�����5j��`|�;�lL ꌘ+�c1wS>Ib���6��NwMt��i�_�쏱{��@x����q��hߔf�ލY�@�E�R�jd�@��CH���"��4�B�e��L#C�X�f|��N���)�I�e��8W��^����$;N����+h�M2�i� Уl.aw����O��4���P{9����CL2z�s����-�Fš̶��~'�"���� N2��T���"�RW�?p�"%����A�l-����}����%Z�'` %d�O�O)Ҟ@,D�o@��>ㆇ�w�ޛFJ}��=}���~h[�K�A�ݵ����ov-3�r���Bާ����`n�䩴�dd�:hv��m~�z�P�s,�T�&�\Tw�M����٭ML��Iz�8iS`ˤ���$rwP�+X��:J�6�lmm+��QR4�`څF��5��"�2Z�A:~�i5����nǜP���EVFw��+5 �7i������Y���7���{�������> O�oB+UO�)�{;�|�GW�HS��*#�Td�L{D��L�ZQ�@�ʹ^3���~��B�����iD�� ү��x_1�L�p�A�u�.0BY���RK�ϫx��ÏG����A�+����}�K�FD�۸�4���A�6!P����μ^5��^��D �Gcƙ������!*3�붭� ����'�,�s��%���4�cm��ֹ����T?l� �~(�4̔���OX���4�J͋�w��#����S�9�P��� ��%*$���:��k6f����$:.���^����q7l5�w@s9�IW9�Fr�0E���y�h ����W�̡����v!2A���$�ɴ�w$���Z��YS�l���� �|�qP���u|C�+�}xwo~�>e�Q�Pk�M�*�>>:���m��,�~{�H%�p�SM6�M!�A"��͓��C�LHwt��[�vH��k�7�i�?�}��D��)�"3]M�b\��D������V�(ԝ�x�eCȫ#�����Ux�'��R,�LK�PtuA^�I�<�Z7>�n3Ey��|���p#��@Q��h�yF�FT�8-��.^���ae-�4��#����F�G�w�I3V�����"(/Z���� ���,5�6g[�qu����FO�|��o�a����Ō)�u%!��&����\���� �C�}t��펩8��ע�)�u���P?�8zL�]�"�a��:j�H���U=/^�X)-G�V҄�x�B_�>c�x?�瓎[���a��Hx�aF#��w�_K�F B��\���[t:��'���e�.�W��4΄�@݂Z�=����P��I�uz���x[Ҋ��߄�C�Uf������W����O��?̊��5���^~G�����l�'�O�xJ��q���O�K�[:����g��6S3�����6OA.S��C$HS2!�B��c @E����(K�����7>���� �A������p���%��zH�?����%�%(��e�����N|\l�i0_��-� �AC]wũ%�0����קJS�Yc�-�P�M���"x/� k����|���t�W�ɒlz���?A���q㉂�1G]�w l����������4Up[LJ�]���E���&�2�Z�B6��6��X���=���#&qȝ)X��ܟ�0*�C�R�(~��K5��'궂��6���[2�r)�H~�\��:v\��ٷf��d����?{)�^?UB�g� ��]Tf:�����u����|�� ߹���i��8�TA���M�iv��kG�X�R������w��'��7����欒k��47\E��t��(c����s��a%L�G�����P�n���'w\�.�7ʲ!��Ѵ� ��̊��_�с6�Żj���9����-u=�Z����9�"�u��5� ���i��š����Rm�����@� 6���F��B�mJ8�v쯌�f@��jq��2��*~\ᤰm�'yȺ�I�����H�L��e�5�w�r(�M������.���ME4s.� ���]{��p�z4�����1�����l�$�0�����| ��%S��F7�.���}� U4u2h2t)�%<�N�9E#_�紆R�A��g0�ա�: ��Ai�f0�v��a���b�z�(�$�ű�\�"4/�gg��X�SdOn]�;\n]���4�Kc��rV5L���mj��X�4r�÷�+��v{���^���{]�E�<1<J��s�hi�P���0�'�T�k�*S�£;~�U�5� �5� �i�3�t�6kh ��4;���j�\��!��²u�y���"�W�[������mh�7��˦e��VlzC��0�,wD�{��a�����5�\������՞��<�W�'J�ڬO:;B�.t`���:qP��-�_�#nw���� no�ssO �R=@��^Jm'��s<�N�9Cr7�j\qٰ}�jOk����YF��_xz-zx�\�����R��Pz�MV�{����%Ӿ����|��%k�PN_��YUD+$+��EFv�)~��u֫H�cj��/7 %n �^���Hz2^��b[NFt �Y�\�m6�����[.R��l�V�E��o�o�7�����(�u�GA�q�NĻ]������VKr[���KЅ2Y�g8ǕN�4��L.C�K*�PL�-2�`,��J7�y�Vn�=ȫ�|�o��i�#H�w��eD{5���r}�Qy8�T�����L��xC��v�R���P]}M0ª57;˅��;�6��#�*P�?���H�&�Ix�Ŗڎbξ ݪ ����U����`)1��3&������!Cԡ`ѣ9�!��/ ��0�/�װ�Et`O�1 8-0�1�s.���i�;~���u�o+_dau19�!�꽚G�u��m��O��n�U�s-a�Y�$�Rf���ߟBW�"J}S�S���jK�gT��%�%�(�@ea��x����\
Behavioral task
behavioral1
Sample
f39c1de5016941194f984f743678d5e01f3e4b1400cde8eb559ab4682f0948d8.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
f39c1de5016941194f984f743678d5e01f3e4b1400cde8eb559ab4682f0948d8.exe
Resource
win10v2004-20231023-en
General
-
Target
f39c1de5016941194f984f743678d5e01f3e4b1400cde8eb559ab4682f0948d8
-
Size
612KB
-
MD5
7d0f351385b763abf6508fc2a5792cff
-
SHA1
4336cdc1e03ddc79f4cee9dc54eab9bf4f87d729
-
SHA256
f39c1de5016941194f984f743678d5e01f3e4b1400cde8eb559ab4682f0948d8
-
SHA512
7771a880abef2944b7de14e31294a2c2a50bd226a3900a90dedd6e6869dc474f2138ff42db273b5ac62f1ab7b2758c4ab604ce5a5649353496dbc3d4385eae83
-
SSDEEP
12288:wNbywj9/ce4I/RQUZ7gHKeLkDScFYt7pMKpirSnPK+O:wNbxj9HpRQEgHbLkDS8YJpLirSnPK+O
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f39c1de5016941194f984f743678d5e01f3e4b1400cde8eb559ab4682f0948d8
Files
-
f39c1de5016941194f984f743678d5e01f3e4b1400cde8eb559ab4682f0948d8.exe windows:4 windows x86 arch:x86
dddac1552f8e9d5116f84cb99b7eb072
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvbvm60
EVENT_SINK_GetIDsOfNames
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
ord695
__vbaLenBstr
__vbaStrVarMove
__vbaLineInputStr
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
ord698
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaNextEachVar
__vbaFreeObjList
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaResume
__vbaStrCat
ord552
__vbaInStrVarB
__vbaLsetFixstr
ord660
__vbaSetSystemError
__vbaRecDestruct
__vbaStrDate
__vbaLenBstrB
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaAryVar
__vbaVarTstLe
Zombie_GetTypeInfo
__vbaAryDestruct
ord591
EVENT_SINK2_Release
__vbaExitProc
ord593
ord594
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
__vbaVarTstLt
__vbaVargVar
_CIsin
ord709
__vbaErase
ord632
ord525
__vbaVarZero
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord527
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaGet3
ord529
__vbaVarTstEq
__vbaAryConstruct2
__vbaPutOwner3
__vbaObjVar
__vbaI2I4
DllFunctionCall
ord563
__vbaVarLateMemSt
ord670
__vbaFpUI1
__vbaCastObjVar
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaVarMul
ord710
__vbaUI1I4
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord712
__vbaPrintFile
ord606
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord716
__vbaFPException
__vbaInStrVar
ord717
ord319
__vbaStrVarVal
__vbaUbound
__vbaGetOwner3
__vbaVarCat
ord535
__vbaDateVar
__vbaI2Var
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
__vbaNew2
ord648
ord570
__vbaVarLateMemCallLdRf
ord571
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
EVENT_SINK2_AddRef
ord681
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
__vbaLateMemCall
__vbaVarAdd
__vbaAryLock
ord320
__vbaStrToAnsi
__vbaVarDup
ord321
__vbaAryVarVarg
__vbaVarCopy
__vbaVarTstGe
ord616
__vbaFpI4
__vbaVarLateMemCallLd
__vbaUnkVar
ord617
__vbaRecDestructAnsi
__vbaVarSetObjAddref
_CIatan
ord618
__vbaStrMove
__vbaAryCopy
__vbaCastObj
__vbaStrVarCopy
ord619
__vbaR8IntI4
__vbaForEachVar
ord650
_allmul
__vbaLateIdSt
_CItan
ord546
__vbaAryUnlock
__vbaFPInt
_CIexp
__vbaI4ErrVar
__vbaFreeStr
__vbaFreeObj
Exports
Exports
Sections
.text Size: - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 600KB - Virtual size: 597KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ