Rb��@�7ں��BZ��r$P �q.rNM��jQS�8t�b4��CAտ��@�^��%��m���N��!_���F���&�0�tN���6�JH�1|���g��)�_����י�k{_6oo����k��\"b��L����������列*�E�"�D]���I�R��A�=�)�JjA�|����=�؊�z��Z5����g�fS}����8Gn�7�P(��(}Hw�#Fgᤠf�3uf,�ُ���J28�^L��f�W�D^hM�/${`�����Xc�|�:|��!c���g�}G���K��lN|�ufQx��O�Ne�?�lޣ�,{W.͏\�����k�S;�gbセX�����rz"w�n��\_Ű������ž���*�.�9G�M� =����4rJ/'��`I��-�1d����'v͌X�yǺ�*�rm�~������n�{/@�^u��eb����MCrJ���?�p��*��{l#1�AǕ��� u���RX�G�oZ�����:�'Ħb{w��iup���[&0E�-��O��4�dY}8���\���I=�Ta�09�CX�� ���~kkAjt�pF��d/��}d��X[q��yK@�ӆ`y�̕hoR�N�;�DA�:�j\�lcİ��$=Y����MC7�܆}��9v�?�Yn3�~��� (�#�bg�_��Hꢥ�h�Y��I}�s�\/�P�_�\���_k�=��Ic�ɵ��>0�ѿ�*ɪ{P��l�5�)���ڇ��RSW��-��:��Ok�ho�(p�%����n����$x�ME7X�|\�JG���9�願��}=��nN Fc�Y{����o�S6�/��/2�M��jD������C(���(��hS4ے(�FF���3�4�mSu2�7�-�YzVcv=��;Y.xZ�-�|�q�e皮ח(�f�5tCuG�ߩm:��6��POlc�6��F�;.�^�ݫEI�Ǽ�h4"��6h��U��߂����j��������s@�����@@�����a������d����A��A�j*�CK�h@/n2�����y{��6�7��ㅚn���{�ǖ i#�t���^j<Ta�u�5'Q�M�($�=��9ӱ��02� I�����Uf6�P��)�Q*�Bs�n�.��p�}�����!�n�5�;��� X�&�2W�~���6�LO��TA S ��C�� Y2Ҹ��=�}k�T*����dL�C��-n*�,p��c��Q�O`�#[��YlQLޏ�r�C?Z��ۇ�y����[�7���-�� � ��y��Ҕ��}�M(��/��Luû�ז 'z��ж�� ȟ �5�B%H���m�jP�CB�� �Y^�n�Q�!pSIqd���L_�ݏ� ��\yH�HyU(@�M�<��P�E��Dϕ�E���ڏB�.�1�4�����lFsR�8J�sM�2��S�K���a��\�f�M�����m��K��Mʒw�o ��L��)�Y�M8^�W��)�6����@ �&>���ԯB�ϳ�W�:-��}���*��?��ȎA6����[��/����KK>�������� �S3<�Q� ~���Xw��\'1�˵���qH��@�����1���N����G��T��qTQ&Zӝ�٫�ӵ��f<%���'����Y ��2�5���<����aHb��-�O�9f� ��(T\�p��?��iV������s�fTe���ԓH<��@�_��_Ӎ�̈́��{�������7p����`�K����0��1 Hܞ�l0yRdY/.X�;@���m���A��,ɜ��f���j��Lc���i��V{��8��pΎȼx�������B�B�Y!@�@S��1!a%)�ΐ+e��WQ9���y�WUx�,������S��Ģ���_���c �DL���z�˄%~-�Mh��V��LqC4�G�m�% �|���Tw�H��Y4��?�[:�AP1���-����X�w(�Tf�g\g��Yr�[���u���_b�J�b�Z��?�� ao��8?�����N����p��ä���B���ai�$^PO7�Ų�N�`����\!H�o����6xCIkOu;�CX�à���3ͳ���\>7�dQB�-+�FZ]���.1���'���^@���x��NH8LP@��9���;�ĕ�(� ដ.cN�����a�]b(��]�8�'v���:�~ �>��/��AYip����f�B�Q+��=5�%�|�q�ܺG�k�B��4�J&_o��?��3MqX4�$��"=Q.c[mp/����C$$�;��lV������C<Z���+G&'�Z�Y�<aւ����& �Kᆄ©���WY>l'���x�{�2�գ�_���� ��^��`(��Gɶ�4c{��വ�~�禞����:^� f������$k���h`�w��O&1��0S8���R���0�������]A�B�T��� ���q��p1��*q�̈́m�ȫi�����Q�Fh��ѧ+�m���]z�����/�-��iZ�Dn/� ���P!�[���B�G�BKd�5~����D���#s��pEèrW*����;��X���l���d[��;]�����&���eB^#�8�Gϐ��6�?���6�N�^����r��G��b�dj�:���:����!+w]�B1���!t���\�2n�(�bw?W��������m>~K�Η�-���{�&B�6,�(��2�?+w./E�M�_AK$.������&��m��Tq�8-���d�*\��a���~8��uA��w��;�Ě��P-���'�r/����0֬7h�1ʜ�LB�)"3�6��Z�M�iI=s�9Rԁȣ�����H��dM��Z�Xd��`��ei@����GZ�H;��nt�lGlM3}X����03���,�[�-�f5{�+)i�7b�"��f��¼��m�X��#�_b�k��JO�31_��_̺r@J���>������!Qc�- IW�p�ե�$��������XD�{�����;1˲���|��a���wfL��y�(�&(�P_y �q7Խ�F{��3@��Z?X�z��
Behavioral task
behavioral1
Sample
2168c4d1c2fcd12f2dbc5ab82239690b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2168c4d1c2fcd12f2dbc5ab82239690b.exe
Resource
win10v2004-20231215-en
General
-
Target
2168c4d1c2fcd12f2dbc5ab82239690b
-
Size
288KB
-
MD5
2168c4d1c2fcd12f2dbc5ab82239690b
-
SHA1
aea2ce3791d5a61b7a249d6e223731ddc3151776
-
SHA256
47c3cab670defee6b9b0f0b1dea04a2114eac60f5dd143ac22c322de75adfdc8
-
SHA512
0aa7722c74831392c16fa8583eb45cbbf19fbcae09f6737ce0cec773f260e84a7a976841134958c9288eddc0fd45bbd75df0b1442a91693ae0cd34f5e9c6ed63
-
SSDEEP
6144:e7DLVNzxsDK6YG2ko/B+JStyKQyGU3jDZeQYoexiOa2:e73GK6YG2koEJSt/QG3jQQYo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2168c4d1c2fcd12f2dbc5ab82239690b
Files
-
2168c4d1c2fcd12f2dbc5ab82239690b.exe windows:4 windows x86 arch:x86
4c3ac70df0f79f9d197c2ad77b38e4f1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord690
ord691
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
ord588
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
_adj_fprem1
ord519
ord660
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaVarForInit
__vbaI4Abs
__vbaObjSet
__vbaOnError
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaVarIndexLoad
__vbaFpR4
__vbaBoolVar
__vbaRefVarAry
__vbaBoolVarNull
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaVarAbs
__vbaStrCmp
__vbaAryConstruct2
__vbaPrintObj
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarOr
__vbaFpUI1
__vbaCastObjVar
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
__vbaRedim
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaUI1I4
__vbaExceptHandler
ord711
ord712
ord314
_adj_fprem
_adj_fdivr_m64
ord315
__vbaVarDiv
ord316
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord535
ord537
_CIlog
__vbaErrorOverflow
__vbaR8Str
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaVarCmpEq
ord689
__vbaAryLock
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaFpI4
__vbaLateMemCallLd
_CIatan
__vbaCastObj
__vbaStrMove
ord619
_allmul
__vbaLateIdSt
_CItan
ord546
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 238KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 176KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ