r��`���7l��`��k���ME�5�O�-^�h: ��E���%K��u�����w �ԁ�L!V)��� �'j=$0cYuWO�u�;�v��َ�x��'<<B��G!�ɞ�v��jc���﹇��3�U��pO���a�)��P��0ބ��4��a ����Y��egX�c�UC���n����2��*PU��x�º]>�����@��p�y��W���N��hiCNr@=��W]���j{��|�_` =���9]G\�xҢ�O9����-���%�#Ae�y5$C���0*�Gߙh+��!LU����!�J���7�}m����z�s�ߌQ-%i{��y�U�6�\hW� �L�|��*�u�|�!�-i�1Wk�J��?"�{�q(���E(YI�؈[t���1[ϐڒ;�V�Uą���Дn���J�#����(�-^E��[$��/��������0`����0�ᓪM�*[�[g�G����"5j�PW���!e����G1A�*�<+�5]�u��x����o3��(��ڮ3��98ZQ��2��� ��9MҗR�c���0��;��rnóu��0�O8���g�;X<�=��$�;���yMH�,u�Vπ9��:�MH��6O�:��_w�k���|�:�����~K���2�B�+X�;eݓ;\�s ��_g�������_:�Ѻ��������`/��C���������4]��&Jk�fq�o�̶�5�H(��,�||�p�me�+�� ���<�ZHV��;}P�e���~D��Q\�C�UN�A�]������*����vP]�%�hs����J�'e ���$g����ȕ�$�@��d����SL5�|��f����cCxЗm~G#C��=���~37��� �X/'Ee2[�D'�C7�P����FQ�d�5q���8��d�)��Ni�Ci������= +��"�ӯ�1t�����\פ��x�.����Vy�gth�����Ŋb��+��p=^p4Ҟ�Ia�\Z,C��p��÷�����i���tf�-����,_$�[Ǿ�����7��Tu��P��/�'�0�@�C-(W�>��M#�[�l��P�^��md3����}X&�$N0�9S�M�w��j�Cw|0�ΘU�A�,mG�*w9'�[�sD�a�>lT p������N�s+4� x����|�:���Qp:ۚ� �c9�dB�C�WK'^�����*-�y��10�C=�/A�`�\��~�t��*�eۊ��t�����B�ΤP�f�AW��;���cRᓡ��RYGRL�,��W��v0'kJ7gE�|���f�zW�xg�и�d�2vD�{W�����I����*&#�����H�Η�!N[�����َwΞ�dt)T�]M]��(0Ia># 1q�!>o�N����kͽY�x��~_g4�M�'1��Ե�L���+�JLf�*�?���Ę��㽟�d ��h����nw�0�a@"���υ`���� �?��g*5�HWT�?C��������JͲ�+���"zE%�h>��Ɂֽ���=�z�@��PkH��ş��� ��0 �?����Ì�Bk��������L� ���錭#�߸�S9<N+E�mwԝ"��5.v<��Y5B;��7g���A�� �q]^ ���Q����Kr�ȼ�I X�Pi'��I����ʍ�.�m�^����h��6z ��`�AHyB�w��>��l;�~��_��57HnR��@G��)�:qצ&�t�fv���P�K�a'r���O�x`%�5`���0`�RX��J܁�:��D2�ͣ�'g�����V�gq���:���s>�� �+<)2�g?�k� C�k���Ҭ�]a0X�g��YSP��2Iu-�!*�~�ß_}�ut`1"��!|��������+{��v�n V� b)�hLP�$v�Ć�n���4N_�-�v�3خj���<�ȱ�!�F�7��RӋ�&U���d�bk �t� q\��m���"��ꪂ��ͱT�W[qU���-Um���b�>1�Ov���u�6{��A��&v�`8�����x�����B����XA��u5\zʟ��'y�YH�Q+bޢ��u�u0��W.h����Ǭ���n��G�〨�{C͠�)E.Z�l�� b!�q�HA�tɽZ����KQs��肵]���6u���?�����d�\nr��_�K�X�|�Cr����3��K�eD�_�n_��_7n�3-:��XDF.@�t�J�k�a`��(��Wlo�ד������}��(R�����CUPy������Ջ��\�Bۋ�M�=�K��$��Ӎ�r`�d���Y}6l����set � %ӄj�8 ݛ��j��t��{���g ��ZP���d��|�s���8�q_�������jtXh� L�gN����SD:��:<$�ɹ?�� ��^:�aO��߰���G��D/�� �I�QG�M�u��"�6x��P���>��/f� �����\�ܟLh�`�p/����tSDGȡ��F�S��>��T��s�ޕ�k����t��Uk���R�J��tF[Z��Pk���[�z�eQ1싨��d��:�q�Q1���R�|��`q+�UL�P�aq��M4pxZ(���֤�<�]�V:�� \��U��H�u;���Yb�U8��������Lu�w!y�U�v��C�A������#3�� �;�ocC�v� g�t��Ӿ���E�R����M^�[&@>��u����75�c�����=p6�~43���?� �B'�.�a�w���[b��5�>\3C��F��H%�:I���BY�:e1;yڢ7UMp9��?,��{猎�o�4XF��S\�ϖk��fDt("���"Vf��Qn���\aJ��W�_?��k$�)j-�y�t��L:;i_(-هϟ���wA�K��=�Q��p���4�`$ �Ɩk#'�2U!mA�c��bBv���)|���+����C$�����R�~Wv�K�����u��5Le'��Uw�-5��. ��Fa��D���V��+,��uM�#��I�/9pO4�N����]�i,��<D
Behavioral task
behavioral1
Sample
52650bab5d15ccc2ae9e3f11a3d88b4d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
52650bab5d15ccc2ae9e3f11a3d88b4d.exe
Resource
win10v2004-20231215-en
General
-
Target
52650bab5d15ccc2ae9e3f11a3d88b4d
-
Size
680KB
-
MD5
52650bab5d15ccc2ae9e3f11a3d88b4d
-
SHA1
447e10cbcc09f951aa822b8a694c41ba5797fe09
-
SHA256
e88aeada998cb4bf2200b04b6b648333aaa4b133d84334deb9eefb8196f966e0
-
SHA512
a85d45df34945924ea38c3872c47b54fe438f40d63aac3a333ef06a70ad98278ca1a07f8ce89329b00f17ee7d3ca730751924b863ef77be567d1209894abb704
-
SSDEEP
12288:GEmSguwN6z0RVONw5TjuT4mBYcqufl+4GRmNHCcewM:Pq6z0RVOm5/uT4mOcTI4GXcer
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52650bab5d15ccc2ae9e3f11a3d88b4d
Files
-
52650bab5d15ccc2ae9e3f11a3d88b4d.exe windows:4 windows x86 arch:x86
ad87b9a6d705ce9a0c7141643029060e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
ord626
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaVarForInit
__vbaExitProc
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord520
__vbaFPFix
__vbaVargVar
_CIsin
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaPutOwner4
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarLateMemSt
_adj_fpatan
__vbaLateIdCallLd
__vbaStrR8
__vbaRedim
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaR8Str
__vbaInStr
__vbaVarLateMemCallLdRf
__vbaNew2
__vbaVar2Vec
ord648
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
__vbaFpI2
__vbaFpI4
ord616
__vbaVarLateMemCallLd
__vbaUnkVar
ord617
__vbaVarSetObjAddref
_CIatan
__vbaAryCopy
__vbaCastObj
__vbaUI1Str
__vbaStrMove
__vbaForEachVar
ord650
_allmul
_CItan
ord546
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581
kernel32
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 354KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 304KB - Virtual size: 520KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 364KB - Virtual size: 363KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ