y�[��O�V��M��F����aM��tǸ���<���84����}5�Mq+}荽�Z�H����ќ���g� `������&�4�Č[2� �3�U���f���6�i�n�3���Z��]1�μ�PX��d�x3��Q�TB�~���{v�o��%ȵL�m6��Pk���%�����03 =1*&eB�t������)fhK^Ku2y�>OMuE�U��r$G�� �V��>6Ӆ�a;�7Y�M'��:Y��`jD�5&��$�R�9��O��a��}z��a��k &������/�k�U �,�$�<À������M�#(D�����zc���d։� �݀J�=`��{K� *��/�d���z�f��`}U�+��]_��* b��0|R^��b���DՔ�M�nb���n�.v���ph�^�.Ӑ���J��\�aXo��tP3�Ie�I�/ ��ᩁ��`g�g��%�����\j��( ��D'5s��*� bB)|I"n�%[sk�j� 1��Q���y^�w�E�.g�v ��+8�a�a��A|�-)�py���tL��B���&Q����F����D�[���� ?J8j�"H_O.�����V��a�7eKi�Z=���"f��[���y;<(T�2�px6eĩ.�����0!3OJ=��I!���T_�8������7���p1���v��,#Nu#�9�^bFY�l)�Pr6}��e��k��"��6���,���H�W���������ݑ�u�=������'��9$4(�rZ{�M�@!��f�zd�~��`;:�g��t��n��S�+�)�`�{B��DH�QoK��*�;� ��M�r@nVd��O���e��T��v! n�Li1�"�7�r����@�}�Y��S��� ���%#�h+�B;�� �ʕ�&�yLj�e Dl��1P�#(��˽]���T3w�|[X�@'{V7F۫� ��wJ@�y�K������m��( �i�铱�b$�ΐ�}���<G*d�^P�r�!^���s�> ���6�#������ڬ��LY�- ���%��NsgL$*�W���u��p}�ѩ�%�9B�ss������Llf��D����ٽ�&��uC� ��������'���c��ȧ�nR��J�#��1�<�Xz>0M���$G�C[�dק����J��2A#��N婜��'v�-L&f�uW���+��O{�ԐJU~�ɀ/��5����]�oJ��>A���2�V5�O-F���a��nt�=w�s�+)���e���W!�˧���)߲���8#��+H��T�w����Tf<�K��V�dp�oҀ{A��[�9�8�������M�w-E%H^y�"q|�i�>hn(W�jǶ���X�;���_��m���Ώޝ�L~���f�a5��h���9yX#T�0��e��ڕ��"��0���2�%��vp\�9��{�cM-��յ,���N���)@�`nл��l�)��:�#�^h\ٔ�p(�4�,y3����'J�ȸz��l��g߉<x���٘��_'v�c>;~�q "��h̫K�x�e�%����:�_DL�Tb�� ��3��J�&�7���|�`��cq =^d��9N�g�"p�rf�#�s�b�����|T���r��b�G��?s*~3��'�.٭����EZR���2*�����)�H���Y&LЍ)��M���0x��p&qLB&cj���{t(��V'l�Z��l������T4�Z�?9B��$8=��&%�ޮ������@�0K5�CGp���訟D���3kG��P/�D����^������`m�|�O��9V � ;�v6H��WW{�[�Cm9���$���~=sH����2�L����2�jHB"#S��X����[����uF9�݄C������<�8�DF����$�&�MK���r���F������i�OQG�C�/��K��\������[��R�((�HB��0�Zi^1&�%xNg�d��&e�E�a��d�Y����kB��E�ʧ/ $���ᅳ�<�Ҩˡ��J�)�,iEP�ϊ=����wV�&���7��0�*�z���U���o�v�4N9zAW�T�����o��Vdp'YC�������f2ol�7&�,��a"���n���v�|:Z���6�9��\���p ~��깝�g->$�`�>��&;�ȿ�x(��wO���Ot�� ����E�;J��1z\x�Bv�4Sl���X���>�U� �DI|��B/$ƍ=��5�M"��DP��t�*J�[~����^������)\\9-Ց�t&��!�'`�,��q��;�5��OF�1^��[�~Q㲭��k���Y�`w�bԾ*�\к?���D�ج�2Q�-+�:t��<�7�0@�.g���L ���1G��B��Z�b�T�ٴ�SX�cJ��m�%��ڱ��7{k��*��z�RN�G��6��:�eb��Lv��H7�F�uϞa�r���ą�Y����fz���1����c��9<�1��m�Pկ���2̊bd�ܲ�z�'F�5�ˮ��NlUg���/,h���G�Z�P8���&� �ը�m��� .6_U����^���f���<)�@����{�8S�T���S�OJ��h��Y�*����S����5�4M���џ|)�c��e����?�Z����̂�ܩ_�y"4���q5��|J/�s{#t����!ڣ (̨�������}J;�վ*O�:�O�ɾ���h��W��6�6����Lg��M����^M���hg�o4������Q��g�� �������d���Ќ0��1�*��en�x7ו��z�{�{��Y��0f�z� 6��yO�8c�vb���&�x����i�������2o��x�fɭ�)�MY��Yrڨ��SXչd��t�T:�!$������k<3I��Sx�8z�'���gt��d�VѮ*��E:^��њ�B�(Z�Ӧ���߰�|5ۦ/�Ill�=|�z&�":J�F8sɝ7O�����yl�yV��n��kSӽկ��קbd�j|��i��|��
Behavioral task
behavioral1
Sample
4eb0081422ac0660760a280169684733e8c4110219178e757383d99118a0b403.exe
Resource
win7-20231023-en
General
-
Target
4eb0081422ac0660760a280169684733e8c4110219178e757383d99118a0b403
-
Size
1.9MB
-
MD5
95cdd4c3745243ce91073e41de8185ea
-
SHA1
327c6230ae77b829d1067b2c2ab5a322ec2f88a7
-
SHA256
4eb0081422ac0660760a280169684733e8c4110219178e757383d99118a0b403
-
SHA512
9cf26330cbdfa1a86b7fce8e0a40c302c1babea7d7f6eea8343c30480224f41bbb75899d98c22f9e623970e312c62ef3a04687f8c84d6fd7e3a6e8614bf51dcc
-
SSDEEP
49152:r/ZIsVlQakA8+Rj4CHxaAIm+80oOGRO8tvFheNPEVqSOc:r/msVDkA8+Rj/M0+80FGRzt9hXVqSOc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4eb0081422ac0660760a280169684733e8c4110219178e757383d99118a0b403
Files
-
4eb0081422ac0660760a280169684733e8c4110219178e757383d99118a0b403.exe windows:5 windows x86 arch:x86
eba5a2fa61a1dc73db5eea1f7a2990a9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStringTypeW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ws2_32
WSAStartup
user32
CreatePopupMenu
ole32
CoRegisterMessageFilter
wininet
InternetReadFile
shell32
DragFinish
gdi32
SetViewportOrgEx
gdiplus
GdipMeasureCharacterRanges
atl
ord42
comctl32
InitCommonControlsEx
shlwapi
wvnsprintfW
crypt32
CryptStringToBinaryW
msimg32
AlphaBlend
winspool.drv
DocumentPropertiesA
oledlg
ord8
oleaut32
RegisterTypeLi
advapi32
RegCreateKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE