�95����"eGm�Ҏ-*#�2�ϙ$���F��� �i��8��l�z�f�?�x.�o4�����䶞��4?����0�.�W�ұbMr���anH���<�����̭87B���;��Z�{l y�j�j�NiSq�4�j�p_��N�!�(��с��a��:f��y��eA�<1+c�5oܐ�{����P�33f�Ū�)Ο��������Y�H%�g��R�@ �n���G�������P���yCKuf��.5�ǖ���lj)E[���Tg�zZEU��]պ#O~S�_���W���<C|���oԺ@�c�����SǒӜ�����gt�1�/�������(6h@��X.{�����Ld�� ���'� ��\�Է7���:�pi/ӳf��A���ҥ@y<鵋� !h��~C8�ѣg\J�o0�!�?2D|ϧ�b��78�� ��E����i'�j��FA����1o̞��������?�@�}Ҽ9����q��|һGT��R@Λ.Tg�{��k�G�g��/,G|��8�^ �q E�7���5<�P��g��|n��ƴ:$_�y�X9 m�U�������L��r����;�hq��R���;�O4#>b�|�jS��b��x�V��J��^�# �4�+ITH�c��b�G���pg���mT�v�ʨ���Ý�S�o�.7��q���-��[���!�~$2��Z�C^L�����n|� ��aBX�i��\킉Ź�o�hrv�� ��B= ��P^V뾞aN�%JNl����F{���4�S�x�@���.��� /"1��h�܉����>�b�EI���4��tz$6�nRe����{=�s��(g; e�֩(_]��Д������c���tSn�O�j��/_��"�v��]+{�W:�%Zj���,9����&��#�u��K9=�t�/��\8x%��}�0�?����vzv�`����0�zn���=ʒCN�� (:�tP)H��?In8�M`Lꗱ�Y~�'w�{��j:�33"��RM0u��ʿ^�h1���`q�$��݃�������t=k&�>ة��W����4FR���a���x'J���h���|.o��*~�K,=돦\o�3���^�FWV��ـ��_3~{���Uti�i8�7">+I(���c�ٸ���;�m�k��6���`�J �Z/�A�^���\���&���o����aU������is<����ؖ��x��!냉Ѷ�y"S��\�G��[럞�5t��r���e�����J��ڮ��\LsC<��B�*ZW�7b����7O���>;?Q�Q�+�bA��.Y�n6��`�Չ]}��C�6��0�-~ q��b�u'��֠H !}���w�Yj[U����l2��ђ��C������H�Z\�5�9���dz@�d�)�&�s���8R ���+�(&dank؈B>�+����7b�٫�����d�Fuլo#�(�3�;;��#E�&�*�NMqs�_�OJvH�g%�� ���1�9:.r������,��{�����tH�èpͷ*��Q��3W���p+E���k���� �-b4�sS�r ��(��v��zx��YNTY��H��S0��"��'�P�t�#�&5?��UITObф�sSˆ�Ȋ�m�������[��ܖ��P�<�(�f���JV��f��F;�~Ö��<e�s���!���4�n���k�qx���-�ǍX��.����q�����+��S��yFh�6����K�;L��ߙ7?o���>+�B'g��l�&@$�`���1�Er�l��Ҭ����vWI�8��O����ޭ������"����G[o�pE.8���(��wZ��[�E�������u$wH��c8<{�s&[���������H��k� ݅�o�ax{���3}�H{���Q�HĊwI�� �V�] G6��(�5/WG�1��Y��v�?V ���6W�Z�_F���w440j�콠�����~[I����(}|��� �?G��M ]ڈ���� ��CP��{�x��݂��,���Iߜ�w���{���V<�jm,��\�kL���4�̛3���O?ur��P{��)�d~I��G7��$�M0���ˊ��J)vkY�5��q�4��R��M���#M!R�vnq@���v�I�ߏN��6Vv���E��5�.�Enw�D�t�)��V��gۉ@&[0ڮ�WU)k����p8B��N�l��z ,��^����N� ����! i �%��|`δ���d�^��!z���z�|B���U��3n܈��Be�搘���AEڂZ�UTg�L_vH�[�����7�ALt<E���#��¹�l O�\��D�gG�&���u2����5#�� �|7��I���X��J�&6�������Iy°v���Q�+@�OF$� �J*$?+�7H{�q��g�>�&�h�nl�dЖΠ�B�F�_uE�z�.�p�l-N�������t[�B��6�#�G���Y�I4[YwG�Co�����k�~�ʷ��D*6���q���M;� �O<=���T1���F�1 ���I�Z��t����*��P.���}&�~{%��w��>���"G��BG ���ql�#-��)���7Mu���K ��ōg?���9���}���v�|�)l��<}�s�&�]�:]�ȤNȧ���A5x�/4�3���P�7)6���qUzg��,(L���(��K���]i�3�4�����>#�mzT뀙��AD4Y`qy�Dùm���L�y|Z\���V�Z,p��s�1���>R�3G�`�*�":ߓ���V��ϵ=۸KUy�8�s>�!��B"�@mF�(IB�������«�>"4���ս�5��"S�A/�9(�ط��(<���z��l�����?�BVVg�E�B��2%4�Ǥ������U���&���͡4��!6w��xW �e�����o}��(:�mpf�>�&�@[(�{������Q�~�����eW��j�"v:��-��P�7L��r��GE5����2���������|��/Rܼ�7�f
Behavioral task
behavioral1
Sample
210a34c1e21e3b08629d641de57ac1e2.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
210a34c1e21e3b08629d641de57ac1e2.exe
Resource
win10v2004-20231201-en
General
-
Target
210a34c1e21e3b08629d641de57ac1e2
-
Size
2.4MB
-
MD5
210a34c1e21e3b08629d641de57ac1e2
-
SHA1
6b92e796ca706fa5136577ea7ceb31a13d751df5
-
SHA256
742e0786d5136bfcc237934ff39171d4e10b7ee2c4ac71e9968be52aa532b470
-
SHA512
491dd9b1947a874bbb06947984ca6830273951e6b7d8943f9d27195ffb594cf5df9024b22b2656dff3c997b4e67842d86926b4e087967a9c811e70bc3b5452da
-
SSDEEP
49152:lriDxmjWjXoM8+ty4ZftqIhDbWpQyXXijgbLGm/iSvEyL:lvKV878fi2jgnG0iC
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 210a34c1e21e3b08629d641de57ac1e2
Files
-
210a34c1e21e3b08629d641de57ac1e2.exe windows:5 windows x86 arch:x86
7f80e15d362541b213fe580cb8b57831
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExW
GetCommandLineW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
advapi32
QueryServiceStatus
shell32
SHGetPathFromIDListW
shlwapi
PathAppendW
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 616KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 445B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ