���mѭuj������1>��D_����������.�o��$��_P��> P��H~v�*��]P>��m����'��LEU�g����*An_��ŴZ�M���k[���>)4ՖūY[��w����5y\N�������T��V��Z���'��eK%�1҉����z�����yy$�Wk��p-/2[�n=̥k�#{��78 �͔)�!t�1{,���S!`�?!�oq̚[ �N 0AY�g�-)�Õb�Q�_�G��¯�]h;@��� �uF�K���t�N�Ep�7��k�йc�L|�[o<ޠ��D�� M1wMdNBrB������G�@��ջ$�T�YP1_�P��=K�!�e��Z���JH�����9M���jt<�Y�s��}|����z҅���F=��t�:-`_����hg�&�1���#������֒�Cխ���0�ٿ������1�U������N�I(�}�ף���wiǡW��N��5�4@+#�*�X2u���CJ����3vC�dCq���<I������]�O[4H�B9�+m0舋�}(�D�^'�;0��x�{��>&{E�im}�lm�q�M�?,����e������&ٮ����Ql� G�{������֑۶l%�2i�\K=��%l*��\�n�+�{*���w\k��S��� "��AT�&s���>��F�5�����T`-$��� ��G�<����I:$Ǧ�r�g���!1�P�i-$�l�B�.z�@E�� �j�>H�12��]I2� ��*�����"����Аے������T��%���x@4��a� �Ń_��a��#���\1q9�r#��d`hzj�RBI.���|��"���f���a�as�K��cɱ�0AAL�Qsago�D�� �K��@1���Y3�HE���k�NXV��R��~i���(H��35����s�eQ��F*H ����/j��oі��ۥ�6�PED�(r wY�;�$ 3~�?՜p���62v�H�n`���>:�c\Ü�^�"B=��&"q�/��n���(KNMyZ3�c��)�+�=X�9�U�ba&kjT�z��"�L�/%:���'W�q�C���q���/��8O~��;�K\ҝ1�w�x�&�X`���=����/ӟºj�I�����I{���q�N���f��Z�� ���Ddl%Q�^� �|l��!������kO�w�b�����|/����9#hW�Rg;�g%Ԙ,w����4�i��S��ݷ v��{l\&'�l�b����V:}�Y턧��Z�)Ou�U�b��(@* ����������P��!�,$�&l=���B�|��a���oWZ���jq"ږ >��`r505/�%W� R��d1�Op�O˯���:�yVIG1���`/�i��uo�fgK�GjEG>�`<���V p�~8��ć�������gm�t����([:��$�6�^�5�qix��xa���Fp���_��3qOR�;�� �OZ3��ԍ9О�d"��^L&K��oj+�� �o�;�Sr� �L��ں��]tW��|������V��!K�� �x�l)��҈��n������)l�/�?ڼ j��}���]��Q���z�^V���-gu�g�!�<�p|�����Џ���^�U�"���^�P�4P����>Z�#ߐ5$ ]�!�J6y}�گ��w�Qo�0i���o���9��y�l���H3g����1�jM�Ų�oѠ�,����dp}�ǀ�,��'3���BD���?�]f�dN�ᐍ�d9��T ���p[��*�cLsϦc.��?jn.�d�O֦s>!a?�Tu���N�Uc�}T��2~�Y}��Bg��&�V�|ce��4s��t�q���u�x��ǎ���e㻂,�2M+��PC���,��,h���v&���D}����x�xo�X�Vi �$c]��oY�;fɫ I[rg<B'H��$ A����߱��y�D,��*�����]��S�$K�B0��VLm��jd*;R��ڙdN��vb~�|���L�Vܻ��C��O��-uI�I�G��V;��{j�46��� ���pρGN������9�t*(y���������ON����B�L������"w��q��xݴ��r���o�E��R�!�/��*�:l���_��u��� �B2l�'�RTp�2���s��Ě���� �?^�~��P�7o��d�z��#k����á%�)��/�k�6��\��_���\M�~ �۠׆^m6�^W}.|�bS4�i�jcnpE}w����������P����.��?̪s����\�����5���V���c\�Oi���ɇÒ9%^?���,RɪvEz4p� ���<��UC��1'�H���Xը$!��~�P�a�磷k��䏋D�T�B�SX��n�����Gx8�� �Ӽ�r�����WlJ��!�L�(5�F�\x"% ��Af�\�� ���!A<��HG7Yp5\6�)�B��ʽ8N�%�Q�� ���z��<zH�"������I"ܑzG��A7�l:>���� />{��'��Q�����/�w}���gŞ�$`3++0o�e�.H��ʞ��F�_&5�j��5��BԞ C�t�B�9�����Ln��m2���ZH���b0�|u�/_Bp'6������������4 :���/c���!�|8́0��)�3�م�4I_��(�o_�@O4��_:�@���G��3Ρ���o��>��櫰�rǧ������>!l ui�~f�� e���&�T�Q��1f���*n �Q�"�A���!�1��oI�q�[?~��l�Xy��o d�S��%����x���a���+�]lj����o��/�J͏� @�2=#-��ڍ�ՓS^L���q�b����������G��������/�qLv�Rc M��ʒ3/�M�'��'���P)�.fʴa�]Jᔏ�� �M����S*e����_M��@�)�s"�&w�%� ��kS=H��d����Иw���s?@j���՟*l�o ��%Q�G�� ���|��p��cqe��5Y7~Mq�4U�
Behavioral task
behavioral1
Sample
92e6c4da1a2fe83612fcbdba8adc8c50.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
92e6c4da1a2fe83612fcbdba8adc8c50.exe
Resource
win10v2004-20231023-en
General
-
Target
92e6c4da1a2fe83612fcbdba8adc8c50.exe
-
Size
196KB
-
MD5
92e6c4da1a2fe83612fcbdba8adc8c50
-
SHA1
5732f0b9d64c9945eded06ef0d66d142b6c2c921
-
SHA256
937b877c4433f9d9d18e677e50641801b76923ae68466b6c37c4710c6a4e7206
-
SHA512
a1b5d86def6ac97f886f4429baa27bbf9b45693245afb5d871fd254b01fb64b0b10fd9bc167ec2fbb848b957201a8d067169740e2a480f8f19a06bb1f5b703fb
-
SSDEEP
3072:muh7oWQqXwhOBxUIjODeDbcGe9ewA3FialrfV9vWUEgoJ1bDBJRPZpED4x:mK03XQBxU7rAxlrfVUUEgwDB7ZSD
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 92e6c4da1a2fe83612fcbdba8adc8c50.exe
Files
-
92e6c4da1a2fe83612fcbdba8adc8c50.exe.exe windows:4 windows x86 arch:x86
ce73d82541e81332c20893dff69024da
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaChkstk
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 132KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ