X3I���U ���Ɍ�;�%>ݝS�G,no$�j�,+nLx �����8/t>�={ry���|.�����d��{���J3��$\�Hw~k�o�:Ku�.�6�V #̭-D�Nh��4a��/�����E��#�X�2E����� �q�wO������g�l�BdRA�|<�6 �ڔ�-���ARc#��*&n�)aބ1U�q��=��Z�\��>֚�WFDZ�&��k�eɈ{]��F g�h(%C�Kڋ�@�Y%�!�7����@X�<�ϸ���6�H�˓\/����V���R�ښ���%M����D�BZv���?���K���!J����G[W�m��]��Ʊ���7rڢ��'�l8����V������đ�1����������=D�6E���F获�k�_�Ys���.�v�*�L�J�p}M$��_���\����>��'y��o��s{Y��f*7��q��5�]�E�Q���,UZa���Ғ#��v�N#F#�83hM���Mn��#pf������3; �"�k�_��{���p������齷2�\?�B��v*�{*�[T��SYe������S@���S�/�D@\� ���4���bX��mɶ��"��EDZ6>�)q�鬸T5�h�Z��[P��E�2����,����B��MZ@��@.�a�R���2��Gp�M=M�Sڧ�W���Q��+L�vC����Ϝx��o��f9�d(n���;cY�B���X+t��B�bx�%/�/3ǔ�Դ8v���H��;(|]�����3�������������I��~/$Ȫ4�@�,�R�π8n4�|�SC��~�[��f���j9����IW�{\Z�Gp�"�[�H�ڍ)h>���b���L���s��U� ���pD�p��fh�X�}��]n��7"S��x�gO^����|�A��g��L<j����,�������e���{�_:�GI��:��6�OM�?9Jч^��3�!��RF6�D�|�l��|������HW�*nh�*���y�nrv��C ���v=a��4a�Z!��ż �agfu���\h-�}46E�+���� ��g{�_�Ļ� ����(� 5�S�0�l���mkP�h�J�N���35Y���2�M�}&��?�}���}��RQy)O`K�ܬ����x�d���C-�ԸK7� ���̊�yT)���ZH�7#��y�e��qvoUA��-���Bx�E�%��h�K�*f"�t��� ���O ��ҏ<�ؤ0i���EQ�Mo����?�^�}�ا�FEAM��c|��42Q���(�. ���ý��� r��2w2UӐ� �O�H�A�,⟛[f���pw�+��7��w�����k���̠�����`�n�ef��x�3+*�}�f��e�����shJRo�LX:�}�Q%A�0��V :DOw�������fWN���Z�t�H�^� D�P>X9Wu���Wx��a}�g:0��I���GCzn��I ��%�,�l�B7�Z~ B-���FR�aG�T�4&V�@�H$0cz�{d��b+������L�K ���t#V��o���Oi��}�^�����wq�Us��0���cO6�~Q� b����o��5f怠�^�,Z��&�Pzo�[���t���z�X_@^�k�9/w67nԆ қ�,�9s'�N��|goGfF���7�f 1��8t#Ƽ a3v�i>h@5����e�mr]�H�����ߒ��J� �>��>��5E��⯘�C��j%��feC_�����͈�����0�T��K�:���s5�i��M?+C9��G�,�E-=�W�d:-0h�'鸐�����5�l#E�&��6#��S�t$�.�?����R���B��G��TT%Ɨq����=5/�Qӏa�y�.W�L�[�0�L��F�&r����?�������}��������W`���1��2�����tK��[��-�~�8iM��i��`gE\`_���T���a:�^ ��d�~��Kn-H���{�B���.��t�|mW��4{ķ.�,3*d�/6���C����e�?ϩ���;�-���IUf5�;Q�]�*5g4̶���Hie��V�����������~ ��ȋ����ÖQmI\I�Aj���|e"70r�" � �Ȳ]�fx��(&N_7���)�47��UY�Ӳ�q����nn�� IAy^�W䒅��`��I�Z;&7��1�I���N���G3�#a��:*�G>���Io��&|���|�.�z%�K[�&�h<z�=tme�˒(��ƍ��Ѱң��-Q swA��l��x��آ�bE��2�ů�<���^��a-.��tS%��_^FƋڊZߞ��t��,zD������/,��vu�OcL���P���uV��j\Ϟ6J�`�V|�Cl��3��)���.�#z��r�j%����qU�*4��s���Yy�oȺj��?�`���DH�j�����#ò�G�ʟd#����mmKbY��&�y��ͮ=��w�V ���~�>�k�����t���Yī^m����Ӆ��o��$e��1�5��V_,�I*��N��#@-�e �G�펃i9p�#��5��zm��Ͳ{� @���k2Z�G�86�x'����a����_�M�<�~#���y��@Ʌ��ml�c��)�T�w�u[����Qu����s4iHB�hS�1S�P�����<&��.r��^���q#� ���x�j�ݚ��ph��m<�(C�U�^�� G� ��õ��9&!#�n�Ҝ��R�|x$y�V.D��*�\�nB��X��E�*����*�s��l�>����b����b�$Ѩj�R��K����<�kh�ȵ��0���B,���4� w*2�l����D|�Ȼn��/\��+v�t�<Y�?���9Dtl�(Q|H�T�)\���ω���Z;�v:��d�6��{�����Wƭ��l)e�A],��"��`��F�^ '�V��00��w��)6|�B���6wZQ�����"��b�{�0�c#���Q�zn�yɑ�.�u1���?�۴��G�k?�1���r��J
Behavioral task
behavioral1
Sample
ebae09af0151622f220b7ee8064888d3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ebae09af0151622f220b7ee8064888d3.exe
Resource
win10v2004-20231215-en
General
-
Target
ebae09af0151622f220b7ee8064888d3
-
Size
1.7MB
-
MD5
ebae09af0151622f220b7ee8064888d3
-
SHA1
6389eee71107af709c1ebb9da83c56f6b85497d6
-
SHA256
84d08bdfdf8412eb1991c35edc00539d55634d9f994af7bb8830deb103da64a9
-
SHA512
301132361cc323a4191888ab19ead3a1795aedb5ee46af9c205fdab69dfbeb3abbe4d6578ce263005bf2ee69e932ece8eb067d24450ed30c4ccfbb0a17b83061
-
SSDEEP
49152:fU6BpvNqcepKVqbwXahdZAD0LcQp/f2RxIfr5:c6neKV0jX2Xa5
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebae09af0151622f220b7ee8064888d3
Files
-
ebae09af0151622f220b7ee8064888d3.exe windows:5 windows x86 arch:x86
eb4bd9a065bfca2f83996e56c0611704
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetOEMCP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperBuffW
advapi32
RegOpenKeyExA
ws2_32
gethostname
iphlpapi
GetAdaptersInfo
version
GetFileVersionInfoSizeA
Exports
Exports
Sections
.text Size: - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 850B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ