*LX�{����Ĝ(��/��E�Ą�����aKW���G�ٿ����R��5��-�u��?H;�:��M���-nd+�9���v���EKls�0!�����@h_y��f2�����G��ΰ����%[������~qoJG��,�M��r�^Cź\f��f���E=�r fҜ����DG�3�E�diD|�U��9J�i�UB.��dʄ}�>�� ؉�Vm�?�-��p�j~�4�4��;�B�p��Ե�Zj���娸�`��AY�Զ �P�7*�:���W�w�D��m�����Ӫ�%�K���{Ю7����^˓PL��.H_ڲ�<q��g?I�n�xߟ?�� 90�G5�6&�JT�6YtwGj�g��9� 8( lGm ��r�F��uS��ؒ�x���i��<�_[ލ����}���M�5�qEZG4A#�d�k��ʶ���M��~��Zvw���ʍ�'#�%�����;���TW���nE)� P�����խ"�?�����>)�?��sK"q�R��/储��u�g���!ܔo���"��"k״.�S��sl���2}�g�qe76�\�q�{��mf�ܮ,��&D��^D��mk�b�t���ꊜ���0�[��ڑ�#W���С��i, �"�l;�l��3w�,Hr���*�z�0�<��NKRط���`�=M��W�U�� �/��໙����ܠ�vʮA��j�nY������[G��{��ݮT��BNv��=�餽��cL_��\<�[�{O<�ȯwl�*���f%���g�}Ӫ߃�^�3�o�G�.Uz�q>�/��[����� �� j{�,��A\��K32HR>2۽��گ�*O_��XWDi�W�͝!����y�H���y�?��p.��e���eS�ʮtU�r6^y��)_ϱ���.�'S�hI�j�u�^K�}�������\�<%Tow�C��8�/��7x�uת�ҕ?�E�r��*S�\�՛�[�(��W*��9�+Ǟ�r������k=� 5���^*����)"�����i�3��_�D+~ޤ}�֎7�q_(&j��ɐ�W y��EZk�y �ܓ�s6p��o�i{�xzS��I�@�+�h�����4��������§����R`=�����u~&f�'�{�� NL+��x���Q����^\L\#Oȱ:�%w���E͐���ۯEf)Qݝ�L/����)��__�s'�zO��nƛꂍr7O�f���y�P"͵�������~���h,Ɋ,��M�"x�}b��S����o��ՙ�bo+Ϝ�<�75��4:��֕�0/��y��@��=c?���u�4G��t�r3ks�`8K5���| 'G�a ��N�����mf���G�}I�t,�<�zt��S�8g��ɺs��c�>��0�\�\C�0/�e]�06!5_3�\��ta����sp�#��ެ���HAΐ��|:����n�oY���ץ7j����tGI�g�=����#�1� @ ���2�����͍��T��l�#�| ��DmqB���EE����KYI6ޏ���w(N�6��A�m��}��쌥,К*Wwzh�DcpLJ�$KE,�j�!_ ��Р�8���;��͝ ����(]L�G�Ȏ��̞x�谎n| om�譮���ְY���������0{���Se���V�W߹��7���Uy:[,���xx�(�z/;�Y8�C�@`dh`���f���3����eWw]-��"{Ǐ/O��lI"���ل�]�n�k����ꎻ��i�\=oH��=y�NW^� �����F�G�l�=,*+�"��Y���s�D���1�Fp�j�g�r�"�J��������*x�|A�^���6<�C!���hC���.�#��K�Ҹy}����zSp�p_���?~�[�F�؋t�� �د�L>n�� :�@��囒Q�k����僷��N0^0c���ҸX���碝����;�NE�jB�g�5�e�G���x�*�P����=�ˀsw I�G� ��bg:~��o���Yw� ]��V�59��&�Vd�P��X��;+��iQwö��R�߲�.Y�.���B5<�DR�f�*��P�I�5(��DK���`~�)Y��� �0�\u/��o��-$+!b����)I�I~U�Kl4�t�Y|�bl��ik_�4������[ \���;L�b��0������x����~�3xU$�;�����SκZD��� 3+��^ֿ7g���;}�\J���?��=�褳��!z������N[1 �(W�(Y�<�xբ������f��}���t� $��b�ؿ Qx5/䰎�$tWt�8|������V�Ы^46!?��U�cN媕ϱ��F�R����\����[)����;�����G �i����S���Ge����È.�!Rq��KF��UH�W�"�s/�� �'��tB����!�OD���}.ǣ�u�+n����T�y�co<(d��(��d!��B���� �c/���I0�r��� �8� l�5`֬�TKۂ��2��@��e~� 4�1 ԅ��ˬI<h| YW�^��\��?��@��j(���L5 u��q���b���k�]>Q�=j<��maZI�[�<A�㻨���6�p�|������ebn@�K��=��~�Tn��A3��G�A�6�wkџzn����#�T�\����݉�Ɍ _g��E0qy8��?<�_Se7p��d~w��,�mOlCC,P�Q>����R�h�g?%�~홯�l�h����4�S�r��e��l� @�{=� ��n�FCRReBL�{�n���"�A�$���:l�L�?Vh���(�U�g3K�����w�÷��?v�KK0��j[�*�4���P�D�Jq�$�'�����( L: =6�ݔyd��#5��~Uh剞0�ʸ�ئ}����<*�O\�-���S�熕�+i���� ��Ƴ���O1:�$Sv�2� y��i�5�}���� [eI�WFX�*0%Q�h/T�A�bB����{���y��,�6nQ5c:U��*��s}5g�
Behavioral task
behavioral1
Sample
164a45bc391d3ef367ffe4b2ed8d8216.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
164a45bc391d3ef367ffe4b2ed8d8216.exe
Resource
win10v2004-20231222-en
General
-
Target
164a45bc391d3ef367ffe4b2ed8d8216
-
Size
684KB
-
MD5
164a45bc391d3ef367ffe4b2ed8d8216
-
SHA1
14265f92e9224cbf424ebc84c73d4405d04d7e09
-
SHA256
dc27204c75b2daf66f7eec3a32fe4e754989d846889ce256a3a40275c557625e
-
SHA512
ba10df812092f24d52f80f7565c0a72bee7cec806ddb26c5e97e479a57880d6157ee49f90ddfbbd6921b9492009e201fe5cfa3cb1dd524fe7fffb1f259b3afd1
-
SSDEEP
12288:9UnHQHv3MHyZX62jaXNnG9aF/+WpEY1L+9V1LKK0DsSKvlTo4D+VaCAs:9UnHavZ5Wy0/GYJ+9n6sSKTKVAs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 164a45bc391d3ef367ffe4b2ed8d8216
Files
-
164a45bc391d3ef367ffe4b2ed8d8216.exe windows:5 windows x86 arch:x86
ca460f1a92fc54a5c7e0ade08fe3b763
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsWindowEnabled
MessageBoxA
advapi32
FreeSid
shell32
ShellExecuteA
ws2_32
socket
Exports
Exports
Sections
.text Size: - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 924KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 328KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 679KB - Virtual size: 678KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ