%抛bO�����r�'� m���I�#�żh�l����g��.=\�oy2{�ZK�}R��=P}=��Q� o�^6傿�Ls���5�W���h+���ػө ����2lP)S���������xD�B��L�=�D7�߳� ���o7f Ć[��������U?���G~��<\�jiG���ʊ,��BA��6�7g�Lj�"�hN�t��@)�����0����TJR���%��/N���>�S��3ݾk�?����͕ٛ,�?�4��:��P�*���y����i �2�ׁ#kMs���I�w��9��`���^���(Y�@��KX���0����ps%�n�B!���5i�}R�d&J8,�B�ax��*�;#�[b�P)�502�#/Qv�g6*r�,q���� �TWJ��$�wn$[*�d�W���H`J��@�j<D���/��K<�Z>��9Evo6BBtJ������+2n{N9)�M�ӿ�u|��B^��Pq��U��k�K1MS6���aSv�9F@}]`�ؐZt�_1q�g��N�&#�����J=o������n�Hy�Z�'#}�����U�+���D���]^�a��4�T5��bb����'X�4��E���8)6��T�E��)?��F���Wa��Y�C�<!ﷴ�4�>8Gc�&�*��bI>&a�w^��_�K��>�&�E%�Q�[�n�p]BoO;�R��TM{�b ���Q+;C G[� bx����K���43ba����X�%O����O���_t���O�;�I"a��6#����r�e���# ���y{iC� � ���NH��1�2����T��1�p$�\��(�"���+$��|�⟨���SF2�M�"��֙�(���/��x�Q5e�~��G���"��� E�-��Oh����6rw5Uwv� ��C��<���6z��%��^���g,�^���+���2&��^� �^��Y*��DoG��"R���K��i��<!'�ʿuAGp:,{ﭬs��f&z�1ZI|~V�߬�J�+%��]�6���ZS��26�����N�w�@��U�ٔ�8�q�k#�5�m `�n�T ����� ���0Td´��n�"m!�G&5߶LY�zLPF>GK1%b�"���0{�3Ƕ�[g a����k���Sh{e��|%=��M���r�gהi�~Y �4���\��LR� F8�M���H�]�>]�>28��A�|v�"�s�H�K+���_ ���X���T��Kt��"������q[������5y�c0Ʋ����@RV�h�BX>p[�U^~L�g}���K)O����!�r�0�o�ē���S_�K��c��%����k[�d���!�]�>z��n�i�����Wq��2�<���c�#x2�W�kb�u*�8�6Nc�9F��qa,�,�|X�oJ�!S�ll�ɞΘ{f��'�Z�T��!��,���m-ge'�I�E �/���zC�*]�/�؛�|�y�5���gN��6��V��!���A:�o܄؍g��w��c�8�� `J~"�f�<��e����j.�uK��$���|^zM&�ΰ��j�Eƍ��+r-��h7�(`Ԯb��П��٦dY��,;y�nv���������́i�\���!�Ѩ�܄�+��T��t���;�Y�������1�XE|J��q�Y¢����d��]N�93�WosA �a�4���?Һ���5���oE� C �W'���nC���KҩzG#MV� ��Ei��@gw��<�V�b���t�Z/.Wc�%�qt8���t�ߘ��&���aP���3�e^��8��e�qT�>���E��9��v2OJ%��E��g�᥎�%��+4����r��;���m����{�k��=P�Ρ������X�}�R��8v�1xOכqڅ�_��J���j�{Z'S� �E���rЊwa��`�0��|�j�Z�I��e���jD�/�P�h��q�G8���o�R�6�7�c�T�{{cc9��h{4�sTm�*C��2�on����t��fzT�����"1z��g��0ݩ߯k���MZ/�O� N3O�#��=�S��#&/�]�4��`�&�z�e ����Ɓ��=,gG8�]E���c ֶb�����c��� ZF���WZXv���i�K�6��m�� v�i��X�v����Y�g��2��*w����C#�̟LVDpyA�j�=�)w*�W� bҢ�'#�j��� q���s�z����e)�c���|9�����kX̌�`�-*����,�\4ov�ga�fb�~O�q�C��;��Dl� ���n����QeW>1�!�N�C��|���5������ӭI���F滺K�&U�)���,}�ɭ�Ыp�ա°��[<�E�/%�����_���U�T6�4䵝J탻M�aP��D�4Z�����G��M OC} 6�,��Xߺ�ě"��؟�@��۸�?����FQ&��Bf5-͉Ģ6��"�oy���{�\��4��=��P�����<�Qa$d]����K�*�7��\���' I)��R�4:�A��p���/�@�\�|��;+U��B�ցr����ë��n.ղ(�I���W�jH5� ����x2��c��\e\�@�&CR����Rj��(�Z��7�n�Y�|�U��qa�+%Ω��ܮF��E�'D�ͪx����9V��t�L�P)�A�'fz�#wM��d��q_bJ�EP����&_Bi�gZe�k�b����!�l�e ��q�#W�v"�'W>�����ʊ�(���f�}?�%�J����d���1���J�< �vEó�|��DŽ�d���o|3"b �%�q������q��K�zﲍ{T{��*ӑa��ǐr��C�����]x�>�GH����&��X,f�fl_�m>�R�P�����3���bpL��=|k�Jwc��NO�����j�ɨL1��(ax�R�ק/�p`U��E5�ѤI��VZv�4���2��� �� B>���� �ƀBnG#��[V�F�%1�N�}U��k�0 .R��<��兯�X�8�NA��
Behavioral task
behavioral1
Sample
4f3480eda94a5092e3376b2cea9b01cc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4f3480eda94a5092e3376b2cea9b01cc.exe
Resource
win10v2004-20231215-en
General
-
Target
4f3480eda94a5092e3376b2cea9b01cc
-
Size
292KB
-
MD5
4f3480eda94a5092e3376b2cea9b01cc
-
SHA1
82220ea7051a3393d2af67aadaa46b37d25ff13a
-
SHA256
e9fe5f946bf2dd699fe571a37ee4ffd0b0da57d3e498aa50f5efea2f7e037e4a
-
SHA512
5c9ef0534d9802ed405b829ea8ad886c5fa33cccfb1f457a0291269109425438ecc56e3019cde09494e65b26f6b64170d8401b1f2323c4f2959543981a746a0e
-
SSDEEP
6144:E4ZvhwH56VRDNdYih/TX28bUuLRvdwvCPOltMr7NVw4p3jpAnWFclfe:Eevg56VRRT2JMvdaCAe7XjpAnkcl2
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f3480eda94a5092e3376b2cea9b01cc
Files
-
4f3480eda94a5092e3376b2cea9b01cc.exe windows:4 windows x86 arch:x86
8572009b172b7c8e8d6cdd1feae9eb0b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord690
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLateIdCall
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaRaiseEvent
__vbaFreeObjList
ord516
_adj_fprem1
ord518
__vbaStrCat
ord660
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaVarTstLe
__vbaAryVar
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaExitProc
ord593
__vbaVarForInit
ord594
__vbaOnError
__vbaObjSet
ord595
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaVarIndexLoad
__vbaBoolVar
__vbaBoolVarNull
_CIsin
ord631
ord525
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaGet3
__vbaVarTstEq
__vbaR4Str
__vbaI2I4
DllFunctionCall
__vbaCastObjVar
_adj_fpatan
__vbaLateIdCallLd
__vbaRedim
EVENT_SINK_Release
__vbaNew
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
__vbaInputFile
ord712
_adj_fprem
_adj_fdivr_m64
ord607
__vbaI2Str
ord608
__vbaFPException
__vbaInStrVar
ord717
ord319
__vbaUbound
__vbaStrVarVal
__vbaVarCat
ord535
__vbaI2Var
ord644
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
__vbaInStr
ord648
__vbaR8Str
ord570
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
__vbaVarSetObj
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
ord689
__vbaVarAdd
__vbaAryLock
ord320
__vbaStrToAnsi
__vbaVarDup
ord321
__vbaFpI2
__vbaFpI4
ord616
ord617
_CIatan
__vbaCastObj
__vbaStrMove
__vbaAryCopy
ord619
__vbaR8IntI4
__vbaStrVarCopy
_allmul
__vbaLateIdSt
__vbaVarLateMemCallSt
_CItan
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 306KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v-lizer Size: 4KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 276KB - Virtual size: 273KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ