��fqhԔH���VZ���W1�F�g8���%=�0d3�-�@m*�8�PĐE���k�-��>��� �Þd�KW���v'�,��W�}��S�BN���A� UQp�M7�}��t����'����SDöqru����X���#>�a��L�$e��;T����>�B"!<q�����V�ό�hѥ�y}��������a��E�x@8K��Aחǩ1T6�O����?zb.L u�O(PS����pB���$HR4s5i��d�ڙ&A��"�!���E��P�(�W"�)|��g��l��j�ߢ�M�.W�n~����p$5�}���������.l�=�cW���ԭOA�!UH�z!�KS���E�������,w�G��V���XCʭ�� ������GDz13�O���G��W��s��P�ʹ��gqd��$:�2�Q��x.�$�Z�^)O���Ą��'�.���/G�-�E��$�;9��������->��f�k��o6�t�敚14m���0"%���� }�"�Z�"8!��HI�\_J���p ��no{E�]��~�z���/ΚIstIC$, ����w^����q�;���+�I�av����0^E��q`@6�bҊջ�f��������~1D%*�$�3�m*�<Cү;#�aP*���#�W� ��$gpé.����"��9�5@� ���������sx��ܬ������_�V�W���*�"i�uyZnT�"x��_���R��%�Td!��� ���9�e5t�{�6�C�-;�y�U0�[0����J 6(��w�������p�/��OyȌ�b�|>(&e�����A�(�+^��M�.r%�')��p+�&��Nt_3����ۅ��,#e�����Y$�,^q8 ��T1m��#��F hNP��H|Q�u��U7ݷՄ�E��7�槚Ó��-�{ko7�F�t{ ��^�_��D(rѯ�R������|�iTO7 W�^�1���kn=����̧2�Uatb���e����C/�ͭe�E�_[�§������s�E���R��Z:0�hm�[��|�e��d����0�����J��/a�������a���SLg���B���i�buO�Y,��=�b]�Q�<y@V^"[Z�<;-�έS���w̛�"�"��˝E�ipu�%����5�� o��߂SE������n��wtD��Ĭ��.T��RZ�5,���vU�~������l�]Vcd6�0�e2��[]�-$��^�lj������]"�a����R��������ŔU�� $ �>�������������q��������X^�aB��`���ǧ���5���~`���8c�8|��;������KYҽl�p�AD;��S���b��#�e;�}�<gt����$��/��ӇBE���h� *�*���tI'%��Ӈ��9K&�Kq�|u���j<g�v� ���f���j�܂�K���q=)�!����aZ�7u�Y�ti�!.�v& �W1��E�BH�lηh�4�{(D"�G`̴$��5�X��w-f <��-~����b�;�E���X*����s2_��SAj�*Y��Vg���1������^� %��lo+ή����ӯ ����xeO�� ~<Z�ܿ���ӫN ?�'�-�"�W���od���+8ӎ���z�Î|���F4Fe��I��h�L8��j[�Ҵt,[^���wvO�0E�Ө��掉�k]����(����gH��ך�oh����-O�w�?����+��T $B��jr}Ж|�,%�6+����S�k�~����$ė!�l��\�T��Z��sbe'�=eb����K����|����I�<)�Ɲ�Qz��b!��5 A�J��ʅ�����k�H�$b4� �3����B�r����`A��Y�$�����B $9� �N��*X��y+��!#Q7�=�����[�<g�.X���*�@@ �BKdX�T2Dp��jz�h�U㛺��yvL���� ����{oi�6�W ��uuH�}���iA���C��)�_����Rh,Ǡ�.P�8���t���)�6PN]���?g[��źp�r 8��+�^Q�Ba�u$?f�����uGʲ��h�~Ү�>��_���`��{�d��[�w!�}���ʊrK���� HӁ������b{���H���d��^ڛ�l�� 35��u_�a/�8Ȋɏ�8���p�~�ݘ���!������C�X|@�M$ց���!!9K�a~i�g�~�p��S�ϱ�5�a\ځ%�����J�Քg��7���s �ycPg��Wr�����M�.�2)\�O�5�+{���0��2W3]�� m锐����2�Խ����W��^9����PsFh[�G����i��_����5�G4-bܪ$p����h0{�F�qgr"�I&}���:�X�dQ��x����/�~G�_�iT���}��Y����v6 ,-���0AJU��t\�f����$��S��&M�ȁD@�\XJ`6��~96�x��o��@o�~��>�nJ9�m3���HZ�l��z�:��(��u��U1r�'����#b]a�� �l5ؾ���5~�!A6L�i���Y���~:���$C��)�^��mJj�3mpP��NI���v����a�&x��]�̭�2*�]o�O�1��L������%�v%B���s�`ާp�`���S-)/y��#% o�b(������\89nm��vp ~�oΨ<�Iʸ��p�J�XIA'�0l����u���!C�4j~�}%`�.���#��8�䀗���j2ԇJ�q)�~ND;`Nce@a"-�>y����vr��9�6m��e?�?E�d���1��o�t�}w��x6�$���y�L?/طy��%AFj�����;���$HE����G!6�A�@|/c�@�� 8Αr������o���<݂��e��*�j]M�fӫx�^t3���+>V��~ߜZ��SH�@$>��{^)Y�#Z��2����5��D�1�� 3�]ׂ{F&�Y�-S�vŅ<sD3k��}p;$;<��WjG�.����"���qU�� ny��͚(��ON�@=���h1�K�̼20
Behavioral task
behavioral1
Sample
0ddcb28ab36bdad5fed23029becc8e01.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0ddcb28ab36bdad5fed23029becc8e01.exe
Resource
win10v2004-20231215-en
General
-
Target
0ddcb28ab36bdad5fed23029becc8e01
-
Size
17.0MB
-
MD5
0ddcb28ab36bdad5fed23029becc8e01
-
SHA1
205a6a6ac7299aa388a5693d4cf3c86be7b83cc8
-
SHA256
702cf31619a9578f91776c9d834e13c0991e30245a1f30a56b71c8ee32ff8891
-
SHA512
6b70b7f19bdd6425c6752f131ab11d673e24f0fba9126f76fbd974455ca80cd56c690a51aae0edef48bff584128598dfd62ebb5ee30a5b1ed1744d97d9100ae3
-
SSDEEP
393216:nOBqufGs0xmfl0pwcwtgnvcHhIbJ/1ZVqpcGrGmc94:Cque1mN0mcwt8EBIbN10cGW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ddcb28ab36bdad5fed23029becc8e01
Files
-
0ddcb28ab36bdad5fed23029becc8e01.exe windows:5 windows x86 arch:x86
9e74e122ff6daeab4a92610375b6871d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_GetIDsOfNames
wtsapi32
WTSSendMessageW
kernel32
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 10.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 27.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 17.0MB - Virtual size: 16.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ