r�=�&���*t��r�y��-�l�s`$������.^�Z��z���]gD��7�TзJ��� 2!�L��P z�� �������Ĺ���*�h��1�+ }���}|���&�ЋW�@OKw�e[q�lQ,;��X��&ӡ��5Ih�+��_:�%G��{YIX��;�J��x��C�G�VR�OپKe�%��LN �7�ƌgC�z ���A������}�79��{f�,�lrߐ���tcѹ���fdw�߲�w�B�ލ��<o����_ }������Oԋ��qՠ�����#ƾ�+�- Q#�Z∩�Bד�1��*�.����8��(q�"����ח����u �~��`q{��q�u�k�_�[�@F��=�v+<;jv�'���|z�"Jg ����b�����a'z�:��`����1�4��D�5g.�턶 }����7���R�2��+�O�1a9��{���0���w��}l�b<���x,X`A��Z��P��w��9I��%.��)�%Vg:5�d��r7�~0��I�h]rep�(�GC�@].�b���q����z�H�AI�у�� �����7n�i7'���;%�\�&Lօ�)8�t�I���ο&o����$�����ũ�xA)���u:�|r6���3�H?���:�w�\;�z4�e).�k��!�$�I{���)�^G�+�5/���3���Wk!�a؟(pr�iek�@ ���G.uQ�پ���E��� f� 3g����������ױ��К�����y+:��9���9����<ܙ�����r.Q�Q���e����������8�Ĵ�T�oi�S�A�]�Q����z��;Ɯ���'/�\滄���� ��@p�W���6����p`��a����f"v�~Z�\�[װOf�*)0�ӹTU�ۣ�eD��]s3����Dݣ���`��gfq�;YZ�7�ƵW D��.���6�q�6��^JZ�x���^;�ҙN� ���~��=]R�R��@��X���֑�O.V�D:DrѲݑXu'\�AtIQ�9^��m �|��A���ǚ���Ƌȩ��_�1��l�(O�\�)�x�.����9�9|z�.�6����c� �V�J �f�s>gї3o|��x�>B��Qܮr�� ��'m|�i!l$�e�u��x�I#U�JQ8p:�p(���д��Z�V�h�Ģ��d;4�V� ���%�EF�Y�Hќ�;&Tj���d�FX:ǚ��&�L;����ѼJuL�����\���x�o�xO��#T$PA���!��g�6<'W���$hf�C��5V�4��5�2��K���Ԗj����>�v0J[�^� �93˅ �`CzE����W:e-q� �Hd`&N{�p�BDR��b�[�Rq����v���7�pː��|�$����@k��%KmlC�"�ht�����1d@6���h(�*!���c��^�W�_cD � 0X�yyI�8�:t"��}Ph�$� U��BwC�b�l����t��������kLA��R�� .�KY��Wr����(Ts��&ƶ�7L'a�ؔ�X֏�j�xJ�"ʿ���\xs�l��)h�n P�����\����GK�0�r���gz� R�����VBD,��A�y�� ���$u�zb���h�ί����C�s���R0�~�~4D�`؋�����h �&���n�n�X � �d֒��=���}�w$0������5>� �wU�rī�݆O�4�X9��v�6�U#�OeM�8�!���Y��Q�����5���X����2x�5�9��~�Ae(~��)�&���>���$�eD���QJPӜ�pӐNs��Bl � �������w�������栞'����sT ��q�ŚK�DQ¿�/l/I�4 ���k���M��7��B �,|°�X��= ^I��a ���qU�קʫo.ޟ|-�ۏ� �K5��Nc�A���8��kBt���O/���UPE��y�/��ԄҸ@.��z{��+RP_O4�*�x�@�`��z��A��[���첓X$"��n��>��N%j5;S�@i����3�`���:j���2�g�A|Z�ڿ�]kP�s�8��59�>��2֤�H��0��Q�|�XH����s#���F��"���'d���^�Y��@DI8o��K��� ��m\����������!Lg�tJe�/�(��Ś��_��{˞rv�"C#���kJ���i�T���F�֡�N��EJ�ʳ�N粻�Y3�F ���~�����.GE-}4a�����7�ѝoH҉D��vg�S��ûgl�z��KI;�W�/˘R4;�aU���VUj��`���H�B��N�L5+��x�kw���A� }�d�"��!�p�Ѝb �W.\s<x�I�%崓A�����y�2-�)�����5�X�p�y p�(ƶ?�Ï�g`Ly�U�O�.n�����l\�/�]��S�'$��oQ�۔d�*���!������ް0賟+by���N��g���/�Y��Ef�>/��"���K����������mD��Z��T��uO����Pb�9�q �K��VI>t�|N�L� �^x� �^���cA1W�(�4�Tlz#q�4C����+Лn4I���_����%�L�+C�?�5fJ��4���+�{[d��g�T�t�w�y��nP}����7�����7����*9t�f�K(��aMW���6�y������U g�<�.C ��n�M�]��p�nŚ�C���� ��7n��eM�%��QT���*Fj*���Eh�?@�v�V��2��g�A7���pV쐘�n{�ð)�iy0��ڙF��{������ L���-l�Ci'+}�vگ3̨�����v{N|�2��0�{��ؕ���֣ڼ3ט��n��MV�k�%�{|&���7���L U�1�g�~�>����j��R�:>�� ��OWb��1���f��ۡ���5s��~� 8�K�h�P��Ň��`)a��z��������3�������@����7������$X=�2��(�(͜|�xsi]o�y1�*���� ����X8��K !�'~
Behavioral task
behavioral1
Sample
a8c76e926d8ea78dd154420dda660158.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a8c76e926d8ea78dd154420dda660158.exe
Resource
win10v2004-20231215-en
General
-
Target
a8c76e926d8ea78dd154420dda660158
-
Size
1.0MB
-
MD5
a8c76e926d8ea78dd154420dda660158
-
SHA1
12484ab68b06bbce85276c0c3472cd03f4df749a
-
SHA256
cdf189d6a0ee7f3c41a26aff085f41c2d84534e750519f866e2c8cc6355a863a
-
SHA512
c7173b1a833c76b094d047a7be020d08239971855e2e5bd042f6da3cca46bfd3626cbdd3abaede79492c533659a3339e5db77e1528bfb462d02633cfcf6cae13
-
SSDEEP
24576:MhJnZ9wHGgk1USJlu3mljUc4a/bg2264az2kOK6IhRd:MhL9wHGrPaWljUc4Cgv64GOKBhRd
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8c76e926d8ea78dd154420dda660158
Files
-
a8c76e926d8ea78dd154420dda660158.exe windows:5 windows x86 arch:x86
da4bd56c28c20dd22c3ade0079ac804a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapSize
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DialogBoxParamA
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 966KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE