nU�/����͘��#{��6��O�W����~��ف"�_O9�%R��<��(��+�"�Ƚ��z�zyLMO.S��kbo/���U���o����Ļ�F�����6�&��F@5;�'>���C�� LpO���Y)Q��q��R%�5����!��'��/w�_Q�f��>]y���Y�gaS�fL�� ܸg�!F���eLn���~���q�xV�:�џ�7Q��0P��S���&��0�G��� @L( �MW'X��V�u.���N���m�hn|�ߥ��4���/��Su���5��=��E����Inʃ��^.�]�����@M���l�%GY�şwW���#��*��9�v4�K�V\�� �wD�ߍ���"���O��l��7��WQ4%����TgY��!ٱKe�eҜ=���P��h�<�k�?q��B�̖� dƕ9�rә� q4I0$5?���7��jq��_G�[E'ӥ��2�Y`Q%A:l8;��j�G��;M� 3#P]Q&@�mY����g?(�d�| G�^�)��~? Nȡ�`�����i��}�DR�݀�<�Ls.3�YV��Il'0�\P�O�;��b�7������v��ampr�s�΄���V7(��_��"�ay����4�3�Yd�E��ϼ��yr��LM�(7̯%�N��r��H��q�Z�_��k��X���Qj�Qt�w�z%ݢz��W����[Z�A:�MD�/a`�Nu3J!ي{�V�qpfh�C�tXZ�FmJ'M�#��Au� i�ޖ˽���%_�ṫJ-E���vKX��*�R����0W���"\��~�o�.-e�S-�rF;�S��Z�̈�V��y�x`�dY��ڏ�n6��S���>�iX�C!���i�a�Y�xs���A[h�����Zj����,#�[�e��8��9oc8�,��j�����!R�/�er���<:$q�Q�J2cyO<�|K��M�f$�X�u�Hɸ%Bމ&q c�2�~�PDZN��ғTG�̇�!:�29��u'��������4�]��K�lP&�i�L�!㱞!��K��c�]��B�lS|78�I�Y>�Q�gP������I3HG/� ǀ�᧪�N)�0�6�(�#����7OJ����8�ks ���zUj^1���u��F:9 , ��� bI#��h����Tʎ..��Z/~�z��4�1��L��F��Y;��/ �F����Y�9\D�}m���C�e�!U�bF���+�\�` �m�O�p�ʩ���Y��Q�Xb���g�Od���5�v��t9#�v\��3ڣ���ɥ�@I�8�l��,~��3&�u\���O�Wo�WgA˭�-h*����d���~�<��O��ʧ[��N|�����\.������5k̕ЌCnb����bG�9^R��}a�1� �2��e�%�w��KH@�9O���U���{��3>6aAj �"v{��a��23�0��Fe�.���Gj���^��I�m5��b���I� �OW��&[��g��_�Ӏ`��9=�0,v_ 𠍂�Urd������2*��Rʷq/�3�k��/�;FT\6��gUy���T���5˥��|R��:��,X{3.�'�]$�lI3��]����>'�0�a�Cw�'#S�γ�x�������"n.껒Z���nRt��L�ς�bN�=c���:q�q19�(�4����,Q�%㘭�ԯ�.H�n,�<.7� �������0T%?F�C9���Ɵ�fd8"�o�&Q���J��}�P��aA_�Z�O�R �������̊I��~Ҭ��3�Q��L{�h��y�����[�����,�i�UA_˱C����|��+�P�ޢp�'��֡l�:��G:�;��n;�AM��SY��o��쭖��|��������z�[���E�֭�3řd;!����z"5Y� 7�m��]>��(���p?q�����Flz�z�=�����7rB ����we���[�A�#����>`PZvS���u��V�o )Y��^��Bd�Q��(F��s��/.")�Q������k֊.d�� N�b�����|@J3� G%�1�]YR����S2���c�+��V!�ş�rrUjV�<��=Ī�#n����#ç�qX��+N�w�ޞC�����(��F3k�ߖz�etIls`��.p��ܱ��k�,������W�������g�/ê+�0��Fs�p ��i���>|�I3����8E"/v����y��W+̬;p$���r3e�"b��t�N��lt�'����S��٨�GdΘ�<a�*K#Z|~;�9Ƚ� W_st�T+Ƭ8X��1�PG���ng�FZ�� w��+Dy30���lP��r�f�.��W���)��'�(w��]ғ?��w�;N���G���0��{��1cT��5Y �����0�d���]����D`�j0�����#�a^&��4N�4P� J�>����Eb�>��ӑ{�co��w��m��bcv�����s.��f��� �I��!jåFO;>���I���:6/7Uh�����ֳ���)2'���X��x������Q ��~v�������6"�R~�د8�4�ܙ��� ���B�6����ҙ �[NPma�-���]k�î�s3t�iI������S�٠&��l�-�����n�o{-K~��k�̓�z$ܳ �N�h�� Q:)bSi�����Q�j�Q�s���Хrǀ�}��w�����u��m\ W*�����v�E`Xr����a�z��M\�A����J�#O�X�ۢ�0�u����D��5�3@_+n��́Σ�zنf�x�RlP�ioΣ��]�`�[2b�\~�'�Z��5A��F�b�E�%^��[O���������;*^�P#qlbC*��2}F��?ts����B��t=�Ѱ�F5�!�\��V=�q|�q���_�`�1���B���++?qR�kof ��{��J�q���yU���=#�������$0"`�ɭ�V�o"�Y6��[7]�p���v�����Q����+�d��,~-�$�w]�y|?��,�j������:g���y�Q��6�i`dZ���V����/��p�_
Behavioral task
behavioral1
Sample
172941014ce1f2ce7d404f0d0b6c5a4103e2024f669605efce27a5d60ca78e97.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
172941014ce1f2ce7d404f0d0b6c5a4103e2024f669605efce27a5d60ca78e97.exe
Resource
win10v2004-20231222-en
General
-
Target
172941014ce1f2ce7d404f0d0b6c5a4103e2024f669605efce27a5d60ca78e97
-
Size
7.7MB
-
MD5
cdd86746ae9bd0c5e481f290956aa0fb
-
SHA1
af29116583f99dc428518111c7560e73b67b6d6e
-
SHA256
172941014ce1f2ce7d404f0d0b6c5a4103e2024f669605efce27a5d60ca78e97
-
SHA512
328cc653a3ec08e638bded71e0e692f30c2f6fc7767d6c1bcb230ce3d1a22c187877b3fd926ee98d1f6114171300931a8f7a5c6a7b8565ff43060dfc6e1914be
-
SSDEEP
196608:F1Pjv0qS2vQCJZrToFOiNnlDiJIe5oD5SGgh39cwSt:zcq34CJZ3oFIZkgN
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 172941014ce1f2ce7d404f0d0b6c5a4103e2024f669605efce27a5d60ca78e97
Files
-
172941014ce1f2ce7d404f0d0b6c5a4103e2024f669605efce27a5d60ca78e97.exe windows:5 windows x86 arch:x86
cd0d5d06657e6676f84534542816d9cd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
winmm
midiStreamOut
ws2_32
setsockopt
rasapi32
RasHangUpA
kernel32
GetVersion
GetVersionExA
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetFocus
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
ExcludeClipRect
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueExA
shell32
SHGetSpecialFolderPathA
ole32
OleRun
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Add
wsock32
ntohs
wininet
InternetCanonicalizeUrlA
comdlg32
ChooseColorA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ