����i��+w���X��t���mi�7�ћi=ƀQ���7��e�`���ٻw=R�5�`A)adq����킨|L]>jT�C=ԓ�E���{�g��Y^){Iۨ2D(�~��4f��Y���| m7E�>�@+b�u��e�)��)���%��[L�n�6��b-����}3rtckHӠ�g���\)�$gko���ݞ9HU��9����U R�;=��j���%Qb���͘ZnN%�Y]�/������wc�4.�:�;���vf,K�NФ�yˡ�ł�����[��ˬJ=W �U|��0�vM�7�9~U�� ��wCx���W?��UdU&N:p��qqv�JQ*�{��=�l�� �]O}���i#vg��ؕ������ +&#�^R�²$I1� ^ \νc��]��������]��c�$��M�O��RK���Ze� �R�� �Z�-R��ߝ [����缝�k:ߋ�~!�E��l��ӹ7���H�^�Gm��ٟ�tp2���GÌ �q�$���/�g��.?��Z{7�=皝d?�����V����X�:\�]��P��_@e����Z�F��3�MT"�������̪!��2H�;"߸r9�@�������Ʉa+�D0?T��56���#�����1g�]:�JH2�ԣ�ue4��W��V�%3�cFQ&���[ ������ ��-G7��^P݅��D@�y�7�ȗ%�E�:Y3a��)��Ȝ�Q`����J�����Wuy��W����Q��?�����ɱ��+q�b2G;�C��pE�gnE����O�_�@@OvE/Nj�Hy1/f?��/D�-�����V�K/��:�2Y|�8^=51[��ٻO��������t"�)k���<�ϬE炏d�w���/�祪4����?amAn��k�45��������xy���0 2Wܺ�̀��'�Cy��DT3�ű��.�M�S�D�H����<Ȳ~ ��wm�?��L���@y_�:h���Ψ�i����pTE~� ������c�~�C��@�Vv�Q�t벛hw�����w�ͭ���]���d�����T�D2%���:`��$�Z�H3yl����*cJU���q��-ƑA�_m��:k�\����\�2o"aI�2ŧȮ�h��\��&3T$��_�U#؞>��b�����rYM��z-W�[S�a�tiR��:x�Ts�<jѥ�f�`4����s��8���~j�k�}O�]�$�W���� /�0B�#r�#�h�1��H�B�|�p�rOq�G�c���k/�]|�c���,���lǦ��w!���]���ed�Eu�V����S�gU���i�@|f�q O�]l��Tt��d��uEB�� ����ܔh���d�\�����Ks�k��Ň2��\̂0����'�2 ���92`hw����^O��'�h�r`8�ˠ�։x�*��ӽ�K��ۦ:�F+�'Ю�Σ.���ŏ�iA����Lj�����Q��I��#� ��!L2���k���5߅.$x�Ob��<���UB#*��.儍�9�Y�W'�N���L�=�M����6f��p?\j�����5�s;��h���ڱא�5<��}C�M����D�� �ꢓ���_ t5\j@閭��P�2z-�[fa��&N��HU<"Y�=�W����j[G�-�/$��\���ۡ:����c�����sl�i�M|�;�R�?ss�� 15���g7�U)���)�,��?c��g;����7�����2��<�3��P�~* px!x.9�ɏ�;�S���Jb��Ϗ��:����)?�\���@L& &z��{�A�_���0ChZO���y�*�k����źw�蓡����Fw��]:2����OZ؇���-�;��)��q�N����l_AjZ�q�B3�Zok\��-�������N٨(�����MKm=c�Y�� B����a*/��5n��F@L@�d��6_�\��ʊ�O�B��I����5#��(�U��:�W;̔���������|����=��KˠtT�/YT� ]��g4;�2�\�l!:^���v�,�n�W�c�FԂ ���~��@P<ܨ�K�=(��Ms�)�Շ���CT=�P��dK�<B?>*d����[����2�/z�"��m�[z%j�mewV�ɩ�r7N�C���7% #��Z|�.IבK�b�k����5���,7�̅p��Dc���I��/�=�����nJ��>k#�O��g]���vD�s�:d�O8�E�^�Q0���e$��n|�������dF�����c,l��:حA�����b{|B���:}%1}����[��~|�`')������:oU���E{5nu��������n�C�?i� ����s�&����g�vT����1Z�U�z�iޜeUʳ�3R&t�eF+Ѭ�ϛ림�+x�'d��S��g3�uZ��SYQ������e�a�.ky��ܪ=�$!W�p28�r�4�@��_���<���������?jf�B.Kg�kۜz trb�B�ۍ���,'� �������ڻd��p �'�� �/�G��)�� Os+�%�l�X����4��3�a�L�N��M>�v�������_�q�����?]?@6����ߝk���Y��r8}���$Ya4��^9�ˁ�;8 �`!7���o�$�s�<j��(L�+ǥ��j��wZ��)�����4}`��LRB� 6���@?> �8�y�;�8ρ���>ۅ&��-a��t���de�%G�HN��������'%�W����$>�oK�r�COf~F1�#j�M+ﳣ��,`�D�h�T�{oqC��f3[�ұ|��,� ��q���eP xx��5�� 1F��\�����W��qB��w���B_� Q&��uҘ��Y�C%��9.�x�k�O�sz����� ���%���c��{��֬-p�q�"�#{x5�'��$B�۞ �J�����n"J�# Iy�a�j��z��\.o�9 �*T��� !��lQأ��/|Y��t<4i����],��<7�]�b�����# �~2 �#��iV�&?>_VȻ��^�)�T��<�zk��i�_~4>�
Behavioral task
behavioral1
Sample
110222039b0306c887de42fe5d5cb1d6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
110222039b0306c887de42fe5d5cb1d6.exe
Resource
win10v2004-20231215-en
General
-
Target
110222039b0306c887de42fe5d5cb1d6
-
Size
720KB
-
MD5
110222039b0306c887de42fe5d5cb1d6
-
SHA1
20dd44425c7b232c69173256e4853c3bd9b51a58
-
SHA256
8bfce9b383bc00bc2741cdbad58cb79ba1752419e9d3f082a1fede79f2b583b4
-
SHA512
7fba4bd64e3becf72a82782cd93d1d919df41d37f7f9c6d6f2598e31311bc4f16617d95a070a32d549daba3d1b1fe7fa5ed1ba632207f4f08f02dfcbe00a243e
-
SSDEEP
12288:Fxbsma/sFAJHHoQgltA0PRBW5Mf1HTZQRn/FOloAD+0lW7YVAG2JrjCMpv+gSj8p:nbs1/sFAJnoQo60PRBWdRn/FeoAD+3Rv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 110222039b0306c887de42fe5d5cb1d6
Files
-
110222039b0306c887de42fe5d5cb1d6.exe windows:4 windows x86 arch:x86
fc14a6faf36a6f2b16ea0951dccc7acb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord681
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 671KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 437KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 708KB - Virtual size: 706KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE