�\w5��_�������7a�I�D#<��_�6\��R�Ozԯ�G7�V�2]`�Bub�q�D8e<�/���؉N�{K�b*�[$��a��K��'X�М�t�����#�r$��<��gM �� �?���A��\���.�{��� &o���82_���a�h�;���^~�)��r��*�t��~���g�M��\P��o�柚�-[���I���ǎ�I���s�*�3>{��;��`�̛�a���Ϥc�����{��]�.�`����#�ʗ��Z5��^xO���d�,�B-Q�J�,���g���+��t"EԮ���"��=����y�8YI�]������&��|9��\n#��.�<��(�|$H�^��AWyl,8LP�&k���Q!LQN�6�`���Fq%�k5��?�����G��Xs�����,�����V�<@ak�cဟ��z���3�H���B���sŇ�W�$�^V:9����`���8�kJ��X�^�@~��~Q8��A��˰�D�I�Z�m�b��Ť���5� �)&!��Je+.�����O� t����B��I_� v���C�åO��"Z�K!/;qW�)B�Y�(�?���%�E�F&t�ɾ��3�3��L�6���6�� ]���/O��' W/A��k��lx�BEܕՐ(�c�R��K�>Y�'�L��)�u��)O��%r������p��Wb��Ǵ��u��ye8)N���Wz��S����DG3�P����T�_��!�?Rӝ&���Г��u��U �y�k%�����M;�J�*�ׯ�_*�ʜ�a�{��Ԟ^��y�Ԍ��@'E)�����m�V%�}�d8 ������"���SZ\cim� vҙ�p��Ҙ�� ������$�4_%iz��}��f�����ٸYC���������,�rk���~/���|����I��;��s0�K�~WU����b�F��������+����>�T�r@UG�lߙ�x��L�� �X���H�M������;$�\N�8����+��i!��&����ƙ̚��k�t�>���'���K^����hS�a�$��]0�@�r���H��S���@pW�M�Y9����^-�f>FtZ�}0M���}������c����sI�*�O��s���������̺�r���N�C1t�_b}w $�h:/���>��!��x���[���t�m��KΝ_��Z��Q���,�,r���p$���ה�%�D�Kѝ�1C�0DE̖�����;�2�f��D���m������ECCnî (`^O��j:t`�^�%Lj��LN�FM�}8k����`�Z�$��M�f�eWCl�zd�J��@�{o�v�2�C��+��م����9D�ѽ�#���Ӫ�/5b���� �=e���@u��\��g㍶����t�n�uխ�� ;��O{����r'8��*�W��+qR�q�{���,�O7_L��}��0��.3F��.wI�q�'���VI������%ǝP�[m:CC���W]�GW�B��R|U��ʫɱxek�o3���Ǧ�h��iأ�6����2�������DK�]Xw乨/w����� ��w���Ը�{�����"!�% �Y��z�.F<���>���վ�NY���y�n�k1�t-�D�A;:�[�D�����x��Dʘ`��O���6c,�1����� |.��S[�VQ����bj� o�YA�:Ĵv��f;+�AI���ѳK�t�""�7A- ś�c����ώZO�zۛݧ��#^Gs�WV=|剜>�n��6T6 ��rI��f����l�������Cm|����o�z���;� -*��˩��fBe�#Y�{^L�Ix��<��|�eB��$��1�ן����B)�{\�+G�jK]��=L�E>|}_�\iT��&�3�O�(���n�I�[5�f��m7c��\�&����.���FJ�.|�=�!7���)���އ�Iß��\ ��R�1K�)-P�q�|s���mG@Y��P� 3�%K��+?`���A:߮���A't�=��+�3ܺ="��ͩX��R������Qt0R��f�#Z�kR[2���M�M��Kkq�JS�ր� im��D�K�,c���ӃΩ�&���%��,�ΰ��x:�����"z9o�K����Oj���L�ɣ}�^���jj�m�+VS�yp�ֺ�M��DW�Fq� fގJ�JdO�z8g\��t��0S������ޱ���@ݴ/2�R�W�<;B�O̧F����f�J�i(n�L�2 �����`������U`D-��+����p~���@�Vw�W���Weơ�A�`����J'��[�����b�����p�F�� [*�ߛ���4^_�(�j�Wދ7k%��C7)E|�;Mu���[4���ޅ��k�on�Nm���٩2թ��IQs��:0�b���_h$�Nd.'��;x����7�_���D9�#�/$4qNDXC�8\6���^��S ����e�!dHSOXŞ$�?��_�+9.�_�k �s�����D�sA�����t�]���@9�Phwn*8y�r$z�*�{���\To��p������IrX���12�ǯ�# �6�8���̔79:�+&.4�e~��y[K1� �����K�9�/H�QO����I�yyYC���n�f������i�y����7�����@-:�-�q�}f�\��8�OV��m��'��<�̢j�'E-��M��V���}4Ou~���E ��8�W�N�l��e��lQ7���PU��43�Q�S+��9�<��@/ ����VT7��i:�4��GW! �grp�XX���٢(�K[��vt�I�Y�V�A"��0�U�Ą��6�T���#��Z��qZK�2<�`�~��&�G��:FQ��*����p�g����9�%��ˑ����,w��?�!�����}Lt��S�(�rv1߆�,�a۲���>��b��<�.�Q�K�������������n�Y~ s�O���"}�p��F��mpXf�5Z��Y��^��������l��
Behavioral task
behavioral1
Sample
1f5be220dccf901571beb61c93ec9997.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1f5be220dccf901571beb61c93ec9997.exe
Resource
win10v2004-20231215-en
General
-
Target
1f5be220dccf901571beb61c93ec9997
-
Size
939KB
-
MD5
1f5be220dccf901571beb61c93ec9997
-
SHA1
36655c462b7d58bda9b1c4dca576c90fd68c79f9
-
SHA256
dc9f76b642a1d7d529fb8440f9e884e3c7615387489d1425deb0b2b338d77324
-
SHA512
edae66d61478fd8f493718b824e807333b11f7424d1d0c0db8cea50fc6fd642b080692ff249a5598c33ead04511080de3e5e04b84bc724c5fe5b6b147fd2fd1b
-
SSDEEP
24576:nOzB9EW7Em8a9terpA5x6AAfB20n8/Q1DOCq6em0DSqsvJ8:nIBaiR9YC5x6JfBZIQpOC5em0DSn
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1f5be220dccf901571beb61c93ec9997
Files
-
1f5be220dccf901571beb61c93ec9997.exe windows:4 windows x86 arch:x86
60b080fca5d4fad1c0ce2258243b9e78
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
MessageBoxA
kernel32
FreeLibrary
lstrcatA
GetModuleFileNameA
ExitProcess
LoadLibraryA
GetProcAddress
lstrlenA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 932KB - Virtual size: 931KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ