�Ʀ� |g����D�z[0|E�5�eMJ����S�-Q�����շ��S�K����ԕv܁T�'�2$�=X �dʭ�Дxe� oE�8t~!G��Lo�L_��[ݨ�'���S�b�!����N�U�{S�F��4�9-x���4'7�t� �א�U���[-��&��j������L����|�I������*�����ʜW^ڄ��� �˓���r 3�,�r�����]�۠��7����=5�r[���ɵ�|&S�����%qp�84��9������>i�J�=^*=����Ι��s)��h�v���i�z� ���.���������$30|�f�E@eh=E�^���ޭ���F��Z�}-Q�l��M )7F�\���+x=gh��?�u��M�լ|,)��ӓB�xj{��7�z�����u9��g����:�Z�)!�X��BHa}Y4iV�=V}�E�Y$��l���;�U��;qR�ø0�ꑪ�A������X��`X��L_������f.c+3^����H��(����fs���ts�@���Ѹ��>�z.9�<tfp ��?��$�?̸��i��٫�?��Z<�#N�g��Rj>�RB6lR�!���$jŗ���kb'�ٷ����=�B3�h�/�sȲ �d�6��������M�I�H�x��M�����fL1w�J$Ch:���74�� �j3�LpU̘���́��m]��َ��7�owlEW�o�Jg.�Qȶ������Po9b%9���'2+��2��O����� Stz�I���ɣ�"ץ�I)N%���`K]N%�f8���q�cGN��R�D�bX+��i����2�^����TXbb�ޛ��%Sw���Y�Dʵj����\�-�;�B忇�.�E�M 5!�$�����}$ByU��J9� ��HO�T�땪494l�^�c#a �8�}�_��6-�X�]��� �ǽ�ɭ�����)�6�N�ݕe���� S��XJE��Z>f=�Y�]ыY�*�ɇ�}[|[����I���nj�����NH1�7$���C~6�`�rJ>v��j|��N9����˧�J�˙�|�[B;{ڴ5:���<۔k�|��Y^�:� �<?^��)�������ٓ��t&��=�0�l<I�u���6w�*��<�ol7���]DW`�N�ZDK��0�ns3�`J��"D;�]����Zm�:�����}`��Ď��2���si��Guf�=�dVs��������=��:�'lk&�` �����p��&��w����v�fJ��ٞ��S����+�fgG�/�������:��z*R����?B�)O�f5C>��}�{��3X��˷H�MD�" ���dL�~�����dK����؏��p]t�bJ�}Uf���7���Ȉ�O9�v!ͩ��A �q/��`����\^�-X6���{��Z�Q��LC������ݜ�J$S�a�����1e�xd�S�%���G+7+�p'H�0��1����#E�;a�Ӷ^���mn�I�wK�D7;b���b��Z}¸˓�� �O��R.~�}���vQ����^Ohi�����F� ЍNӤ(,�;#_�2!���+t��c����b��L%�g���F�3���V�~���� ߍ^���okL��1 ����������g�Q�/��v���M� 6�LCb�%9�2I�}R���4�9��Cʤ���;�f��2�y� �BT{a�[L:`�q�!j���*Î�U��t��+�������%W=�n����y�.��*Ć̠D18�48n+����~I�9�G�ݕZ;�R˴�M��|;y�FY6�"�������<�%�,=�ޞyy�M�J�g�����2�N�e���㬘���S���qI딩���*�P,B��z��3U�t��:2!�Ӷ嶙�t�Gp�3��L��~�����0�Wi��4 �8�+�pydT�,�BDqE� ���~J��>��)��`�撞�M���e��M�J5;k�*��k/87�5��f�'���Q�Q4n���b>���,�Vq�e�[�0�y��QO��R��>)����4�AӫA�LJP��)\�!>�.���H����4*�#o 3_��ԟ��73M/����h�H��F�S�N��9G9J�{�P�/qJ`����6����P�sӊ���4�b�[�������'C>�(�iQ\K��ͪ �P{����^i�"����_���hd�fX��A�^XWNН�g/�Z/��S������)"�#U�*_\�R������>�W/gz"�e���oS��9�c����~>�,h�|(`�q�US��%L-��ɉ3x���e�>��d6�}��JP����E�l��rԨ����j��]���(��6�%Qc���=T�����y����2�n�Gџ��iq���x:�&�x}rTO���[K.2=�z��0�D�+���`�}Te����thgg��� �M�!:3q������L/��ܩN0��4����t�Z"��}�4jpህ��@�����wq6��4��=������{�A��3�EL`���~F_xͳ����s���6��܃�\��b�/�V_���>cq�G��!�A�����h���b�dK?\��wz���9Хt������M�bv���ѳ��K�UC���Aq2�n��r��;�cJ*�i%Զ傚���Ժ,r�R��y�>��B�s�u&�O�v^9���)���ew\L��?��}���\�P���/Œ�SVt�㨻T�J]�K��^����`~�@˩%D08�W;���d[|1��@E�$�3� h�8pU�yK��W�L0B :OK �����=#O��"�֗AL��nD���Ðo�a��/�Kd&��K�=sb`�Ҕ�5J3�75�.V�L�|��J�<����DZ��M�ë=�����2�����O��A�c]�ҐY�x���'�����3i�������o80� ����oPh�fsXpE��G�]F*6 ��"�s�N��NV�_S'�w'/���H?�u茡�f���={�%Գ��2>r̈́E@XIix4,%���]#?�Wa��d2t$^Ym\t���wM]VƎ���<T@��0p��b�� ��|��M������{
Behavioral task
behavioral1
Sample
1e8eedc36619f01a58ca9e5ea091cfb7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1e8eedc36619f01a58ca9e5ea091cfb7.exe
Resource
win10v2004-20231215-en
General
-
Target
1e8eedc36619f01a58ca9e5ea091cfb7
-
Size
1.5MB
-
MD5
1e8eedc36619f01a58ca9e5ea091cfb7
-
SHA1
4bf306df64ce85119b0c5fa792781c698d4b5468
-
SHA256
db826047819bb7a64d6fb53edf7e01cf64d258698a779e3fb99065f3ccb4a987
-
SHA512
837f6c1d700e264de86e8b6743d52594fc4dd87d6914898af43e0d2cc9216ea5e7b3d0e8def02ae95b8a6d79609bdb74e193a3d2c413f23d37245828876abb4d
-
SSDEEP
24576:VplbC/+YRtdQDo/+e7KVkTR9bTBZGnXY/D/StlC8dr9nxsAsY:V78VdbWw7TR9bTBZsY/utZr9n+Y
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e8eedc36619f01a58ca9e5ea091cfb7
Files
-
1e8eedc36619f01a58ca9e5ea091cfb7.exe windows:4 windows x86 arch:x86
2669412b4eb223fa481834974423451f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasHangUpA
kernel32
WriteFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
EndDialog
gdi32
ScaleViewportExtEx
winmm
midiOutReset
winspool.drv
ClosePrinter
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
RegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
WSAStartup
wininet
InternetCloseHandle
comdlg32
GetOpenFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 601KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 984KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 369KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE