t�y��!���S+�Y;������5`���t�IR��t+�'��E�n�ڼ�=��_n�!2��Ur�X�O��;�?0��B� J\BB�V��� ��@�P^����{��uSp������3�S"�q�ј>x��] !"�J.�+����hOA��u�k�R@���p���n��FU�6���~߄� >N�yc U8���Y��Y����-�V�F�D ����J��=Y��ȥ�`` ���ǡ����{^�Ӥ:J�O}Q����m:��=�w�@s�o6�ı����E����P��j����0V����e_���v>X�l���3����e��&v@zKN�$}&A��r� �A&�b]=�I�8��瑳�-m3���L\-; E��9S�����ia>%\�J�<�#Z&߮A��x�`U!g��n��lc*�HX g�4J^����U*��õwO�6���f:��.D�V������CiA����xM�2����j�I��:��(���A��������Tf�%�g�%/�X�;�������'4]+δ�y�|���ia�3�t��F��)� ��R�_�<^2<�� Ѓ��"��x"��o�s�����<��h��+���F��Y�8�2��[m�%8���XWr�a��N����0I��b)�pWp���g��D�H��ڢ,���d$�AF���i�����Ki�Bl�k��gUN��PqלhL��1��� �cӂ�<��OVM�m�r)�p,�[D ����[\��h�x�q�)>��Qߝ>՚�x6�^�9�O���� �~�ݤ���Qn�wjT_�=������l�ō�e�����F Ը�_3ނ=���)��7K�I�M��@G�O2�ն�Z ��D�`��t�Nvx����ȗ̻I �&�5�a�v��I|�7k�b1}bu�˽�Y�%�Ϧ �� �<A|���s�N�^�QYt���Q��a���[�A��%�0�0����:^ �9��g�D`�pC�8&"��mE��7"�H������y`�nzʍ+������Nw+��ˍ���&��B�G�2���lŠ���h2[.�z��h%{)Ƒ�}6Wߜ��d ���OL�<Ĝ�6��*��\�A���G��*(��y�0�8���Ҏ��� �|��>`k� hr]c�P(/ѡ.�6J!R3�ɾ�e!����7~ �V��.�廃�9���J�~�>@�6�ϣb�yo��*r�N��,���6`SO�N��9�@�z���֣�|u���cc�N��K��iv������c8��ϹM,�{TR��`Q$���=��U�ތ����o3�;b>O" 6�1"ҷfݜyѳSbu��(;I�A��g�T�l�� ݮr��������G�=ĬSh��^�9i�n��N����|� hCXP��dpK��2�^#�����a;��T�`�ջە��������.�翭W*��X�d���a��o��`���a��\�H���)a:����mHg��.ɨ[m��Xn[ �3�^IRb��f�U�4�ފ�5��ɋN��&i꧹�������A��*q����y�u�Z�8F��<� ��N��,�f��re��cZt���9Q�ƌ��5�@���j��<7<����ug��¾#钀Z?�h��ݸס��˦��nA��ޝ�*��\i6�XE�_�&������f��"�2�@F���ֳM�I ��C��(IU������OJ-����B4q���J�H���X��n���Д�hQ�1����G��ކ�S|��o��*���� +�E�cS|���,�ye�N� ��a�Ћ��T�}� ,�����^���[Y�>��jU�S;��<��گMt��N��5D|�M�w�U��������&�ޜ��X�G�o��#ʶs���1_O֘炉�)����w���H������[����%��A�� �<�{�ȅ/3�w��. /�6��4�n��n��.(��,�)I������qO����/%��H�6�dvw��,~y�RFL�^>6�{�R�K�hL�c��^���E��U}JJ-����rR7 M7�3�`hD���p�0#���L��!�i���� yOX�-x��+�tٝ+��P��Ve����#���G����?KY:�Ѡ�1�V mD�X)��ê���>�TΜy� ehͯ�+<�W9�+��g1�Vy���SҠ?�Uj���-��q�hn�ՀR#�����P���i\�*+:kkZʂ"^�����υ�<+1�j�%�u�*C!���ɗ���R~Z��l�6Ӥ� @ɫ9�;Ml�ț�G��Zdԩ"̷ڈR��p.nW�'���F���]���ÊTf�t�sk�?�Dx>{h�J`Y5�q�K�P= X��;QDG,���<%:��s�Rg=���^�m�@�Z�vA����W���#������5���m��?� !�?"�͉H���$�� [�WGݳ�����]v{�<-���> D�NH�r�`����q`y�%�ݲ�$K� �� N'��:"��m��$:�(��:a��X;WN�c�\��EP5�;�s�H)>wh����K f�O���fɬH�3Je��YW��,��;������QG���O�R=��Ў*�}Ќ�P� ���&9|QR�{y��}����h܂mU�S� Ȕ�ژ7�w�bQ4ᙉ�af���|��/ �rV�8j)e�� E_F����4*j1���]�99��y�Q� ���x��I����q!�#͚���Ky�,j��f���<{��:r}�� :y�lk��N���/��ň�'b�������=n�))���"�41�EA*�%�6[�������p��+�ф���|P^�KٖN�cӊ��X��u$ޜ�I!cQ����+�4��рތ*��l��#1���9p���p�YNFѡ�����Γ���0�^���4U���\��c7�U����M�DP�_:��JQ��.�����}�D� ��? ��i��B' 2�0�hު(��&�����N\�l�Z����:L������x;���"'c&b�:�2Y���H$���W��%9F�E�%�~�˓����<�n������'�� S�
Behavioral task
behavioral1
Sample
ac0863a16c5cc7aef3730424ee8871fe21139739858b198079a97288abcee366.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ac0863a16c5cc7aef3730424ee8871fe21139739858b198079a97288abcee366.exe
Resource
win10v2004-20231215-en
General
-
Target
ac0863a16c5cc7aef3730424ee8871fe21139739858b198079a97288abcee366
-
Size
13.1MB
-
MD5
cb043b4cf65a3704144f4c0d4a84c225
-
SHA1
aaa372b4a81a40ee326fcf93901dd65578dabac9
-
SHA256
ac0863a16c5cc7aef3730424ee8871fe21139739858b198079a97288abcee366
-
SHA512
ab1646f9b648bd594a829e65a62b812614eef453d09022862ff19aa8803b3aae5fb6137b71989220ba738c35af73d61395458a7f7ac308d9fc1814e4b4575a28
-
SSDEEP
393216:ptej48ZXHuNVSvEKLmwKFhZaidvAR8o3Jg+:ptUteoLlkp08o5B
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac0863a16c5cc7aef3730424ee8871fe21139739858b198079a97288abcee366
Files
-
ac0863a16c5cc7aef3730424ee8871fe21139739858b198079a97288abcee366.exe windows:5 windows x86 arch:x86
6abc3c92f00be08b9f4c8c2fcc800d4e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetOpenA
winmm
timeGetTime
mfc42
ord5759
msvcrt
_exit
kernel32
GetVersionExA
EnumResourceTypesW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetFocus
gdi32
GetTextExtentPoint32A
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
comctl32
ImageList_AddMasked
ole32
CoInitialize
oleaut32
GetActiveObject
cj60lib
?SetInitialSize@CCJMDIFrameWnd@@QAEXHHHH@Z
shlwapi
PathFileExistsA
msvcp60
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
setupapi
SetupDiGetDeviceRegistryPropertyA
Exports
Exports
Sections
.text Size: - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 12.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 11.7MB - Virtual size: 11.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ