�k����Bi��|���:�� �۪"} (�r.�C�¡ �Q�./��zFP���F��1�� ]�U�����ڒ�]�K����}b��������D�%Ae'�ۿ!�i��ҫ��-�e�ʣX"�0�$����G bf^85Ǫ5�=�a�����e�/��mX����O��q�uv� �\ǞE���o���ơ|צ��5a��0��ςʲu���[��8�Yh�]/'a��X@JY�&��Q��\��:�m���53���④V�ި�Udi|��m��b)��p�V{l=���s�U;�� ��hA�ǩ��]v���)h�M�\���.�����j:���ݟ��3����1�K+�� ���#C�� �}cjT��RkT�. ][;�βoO���Wx��-�sA�ڊ��[�b�<Ȑj�~���o-DMO�HP19���[,��\��]h�;D��b�8:C`ĺKΗ^J.�q������� �VW8Θ��ho�p9r���E�Ks聝3��������k%�� T��Kd`��=�$J�Faɵ<+lY��_GCȏ�Qq�]����xp+q�:�h!"��gC&�+g��[M`mV��7tP�� =_I+��!��b���� ���cٛtg�n>au��i��l�l%�֝��@ƝUЛ�V�ֆY1߀J��m�?_�a��>1��DE���9�����v(0����·%H��B�yo���'&��5X�4Btv �t �t (�N�����7�������Q�&"��1t������e��Kq��3�#m̉=l����7��/���:]����+*������D���o&]ֿ�ep�mA�SrO��r��:$�k?V��,BeQۋ�3:�����2^t-�%�t��)WQ׆��}w2¨@�,�5��=���M�H���ǐ��d N��!��+F�ZG���@6���O�{����}.Î~7�a�w^:�[!�f��B/����,4gz�`��%�n���-b�C���Ó��9J!�c�n����&-;���mu�&�-����?�E�$��L���RU; ���(�]xw��a'���-��k)V&V)`V��y��Y >h����� ��iH��kq��/hR,���AK����[�1�hՊ㼧��/�;�_��W�|��� ��|B��-&�C��t���������NfK�$O?ǒع������5e��K.��mV��x���-䕽����Y���J.X�CO�R�>�kI����|}⹊�U�+-��j�9�#��bˏ��/h��X�ZE0\�;#�p�u��9�cs�M}/�"��Q�����l�uϻ�l�⪦˼��8�p9:������;N��l�8p��'Ԇ��h"Y��z ���@Uq��rf�[#W����<0�?�fb��Z٪�W�t�L������Z�(�4�|����=ࡄ�`S����=�B١SI�ڧĝ���P{�z�0�D��+7�"'�'�,��if�����0�ej<�'�$%�/rr���ȨKR䵔w���>���&8w.�hB�� oL����UG������7Q^'��H����E��)q)��.�vA�(L�|H��rޥ���d�v�h'̪>�*f0�"�р3w�}J@��y�21��hݘ��`h��vLE�Wfa[�x���ls��1�%�<,$����;�:�Z��#�����Dk�x��E�u^<in[n)�+�1�9�{@q�v�Vt��(�l�"W���FK�F�����1_�:��>�\ch5V�f� ~��=�l��͢S�u���̜53�2�(ü�;!2����MSv�E��������!�8}2�t����^�ÝxKn�����P�E�� ���2����!Y ڵi�gA;�FN�3Nni�2Ų���n��!��E���ڴZ}T��/��= Ffd��O���O�[R��-�aBҴh�8����wX���]��"I��k��~�֫��g��lxQn�;4ʻ���DnN��*��-�G/u���JN�����}��_n�� ��ˌл�Ь�����IQ[��M�l��(�իٓ��d��T�}ˠ�o��k�H`�z(�Kڻ��I*3L"��X>��r~���v�����e��U8#�?Z=q9���H�ta�R0�w��i�6��U������\S�P���$n�K��۹����9�V2-f������)7�V�����n�Z����fq��17l�𫅅�����S��M*@�;(s��,S����>����8�c�q�{�L�};- ��$� Z��R?�ۨ 5��)�ט"���6;�"<�"0�p 4!���,$��f÷�8PS�)�ª�� ��sʍkL���5�3c�1����u>JX聳h���so���<#��?�" �M��c�e y�B,�$�^9��� 7��\�i �����g~.+�g����v�ѩ!�[?��c��~V��(�����JfuMz���eAW��^��mua��Ho+o�II>��;6N�����B� �d{�י�Hx3g�V�P��+6����ro�k�~w��g��O1Z����@ 0�l��f�����ԃg>�c��)^��� L$��v)��*����n��#f����}ˈb_�Vt���l0.2�j+����5�/ *q�t\��%xǬ�i;�tL��ͱ�X �����BTQG���ʇ��v��b}���n���CK景��/Ҥt��(�@�̍����1琾Xվ%�����Yɂi�r~OΣ�y2�0��a���/K߯����oc/��;$�H���,����zYPdo�i�0�%D��5�-�8;7��M:Ȫ����Xh?�d�v(/��0h��~��/�k�G;��ω����{��T�Θ�|U�emO�R����[UX����HUy��k��5F�n)�2lG�M���Q8}ϗ�"�T�a+�(����Zk�r ��!M��k�({��W���t��,��J��I���`�r�?u�`T�b�f?װ�B>w� �Ț�{��YN� dAV:�����v%��,���"M�vܚf�0XQ������9V�{sq�s�;*o�#�2.�:MW��T�M����r([\4"
Behavioral task
behavioral1
Sample
4e6052549ed5123687eed0eae30a7844.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4e6052549ed5123687eed0eae30a7844.exe
Resource
win10v2004-20231222-en
General
-
Target
4e6052549ed5123687eed0eae30a7844
-
Size
788KB
-
MD5
4e6052549ed5123687eed0eae30a7844
-
SHA1
7f30280f0980b2518821da12b30d63d9a3179d54
-
SHA256
dcb2111ff1b3fd2f13487396cc6234f3d5e5e5e1396aeab0521340a6a13096f5
-
SHA512
edc0f7fae8fbf0692147740b96f5d8abbe186631d8c4bdf6002af8f6a1e0662d298257780adad6045a717f8c80de29d0d3af319283b46f18be1844aa78e030ee
-
SSDEEP
12288:0nNB7eZg95DLmWdG6lwUxo/Shl0Xj00D0zolWDlYJBb71kL/Zz3phq:0NVeMsZ4wUq/moZDS1gSNz5hq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e6052549ed5123687eed0eae30a7844
Files
-
4e6052549ed5123687eed0eae30a7844.exe windows:4 windows x86 arch:x86
5797b7f4d11e9802bfa77e4e5f08be4b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaAryMove
__vbaLateIdCall
ord588
__vbaStrVarMove
__vbaLenBstr
__vbaEnd
__vbaFreeVarList
__vbaVarIdiv
_adj_fdiv_m64
__vbaPut4
__vbaFreeObjList
_adj_fprem1
__vbaResume
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaExitProc
ord593
ord594
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaFpR4
__vbaFpR8
_CIsin
__vbaErase
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord529
__vbaStrCmp
__vbaVarTstEq
__vbaPutOwner3
__vbaAryConstruct2
__vbaPutOwner4
__vbaI2I4
DllFunctionCall
ord670
__vbaFpUI1
_adj_fpatan
__vbaLateIdCallLd
ord569
__vbaRedim
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord607
ord608
__vbaFPException
ord717
__vbaInStrVar
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord535
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaR8Str
__vbaNew2
__vbaVar2Vec
__vbaInStr
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord578
ord685
ord100
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaFpI4
ord617
_CIatan
__vbaStrMove
__vbaAryCopy
__vbaStrVarCopy
__vbaR8IntI4
ord619
_allmul
_CItan
__vbaAryUnlock
__vbaUI1Var
__vbaFPInt
_CIexp
__vbaFreeObj
__vbaFreeStr
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 977KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 736KB - Virtual size: 735KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ