jN�ƣc��)\H+�g���+��2ax��H�����0`�+�B��&$���#d*B�w�{^�S?ʼnY�?g���M$*�f��f�l�Ѭ���7�1@��������l�V+ux��ϲjm���N���.&�g?R[y*�d�xZ `�U�?t!���@L�Oy��6۳N�5PE����ò�U�5��[mn^6����Q��e�^�7iZX��]h'W�����]�B��;��*x��4x����t�g��&po�v�W!�$��zg�7���w[}�ΊY{�� AC�]d���NYrr�g�J�^��bQ�\�?�Җ�n�#{���(��-����Lq�ʵ�[������]��=HF맕4a)jZa�!L�%�D%4A����6�=$swo�h�9$����`OJ�.�_*�#y��:�>R��=�&�p��9�P�\=`>��L��r�Ǖ ���V��ǞS�\�x5`�����]��<H�t4�k�����؞���6/��I�Sf���t�g��q�3� Q���m�-U��J��T�̀�����Q�D��:�&���1?�ֿU��rQ����qQ�k���1�sX���u��]�4CM���\�\ꥴ-o�DN;�Їf���[u���-����G�Q;d�M�|�A%��Ȑ����?�[&1�ϊ�:��*n��do ����x�xq�� ~�^ƴnO[�E�^I�/J,!����3 �S�;�����T��kꊹJ@�:&5N�{�A�tmp$#���tظW]�������8���j!������9�4�����#,�� �����eP�S֪�l�@�����nuӈ+2��|\?4E� �+�s��P��K�Ë��^�"Q�N:t�;� �kB��� ��Z����(����-X��&�h��c�)W��'���Y�F��/0g� ��d�m��AB�T�<ZN�'t©�H���Sʵ���t����f��`�Qs˓�Mz�)��&��9��Y7��_��,�}�6.C�d�/��#�⡘,[���L�,ZMJ1�nP?9$~eJ���.`Z6����R�+� ��<C���d����=�_�l=���t���3k� ����,��A���P��M�0�U4��'$ˮ�����\��<τ�.6��.�nc�4����[07�s��b�����Z&��X|F�9 ��wϽ�o���K��2����Dow�����aqKԗ�� ����q-����S/�GO9�9"BJ+���Bg��]+D����-����F-����;�l���:-C����!t��!?,�5���O5sCh�@�a�$`� CTi'�����Š���x��|�@G�5"��q���ϝ��H��L�k��J �y��d���)�:�qm��oa ���]!o�l�|�)��e�4�em��~��y�:ʠ�rIC}��<���Շ��n.ߟ��)�>.�W�h�6:�j�"��$� �mָR�"I�I�+����S�(�W�����x��u�9YM��]?��T8�<K��W� E$o��|�:�}���@/��N�V���JJNat�1�_�N��v��lL���J�:�̏1��I&�y�xW`��0�X\'M��La��o�<n=-��@;vW�{jui=����-�T2��S�#5R��+��x�-�nN��/e�}>־�9n�Gi}�H������2��ִ��o�)��(7n-C�����>���T����$8���@՞�\_OO�A��ˣ��ē��8(���M-� {S�F�r��}K���HaW*y�"ijbQMMU�e��_��)�/o�N��(��v�'�1��R#{�(�\�cO�DJ�$х��'��U^z2�=c��T��ݮ0����]-(���Q:�@i��2A��'Ak<�y8G ##A�"bCh�Dң�ԥ�Y�%��<7##���� � ���$:�����\pN�SQ#l�+T�.����H�mDC^���&�+����u%"ԉ^��FK`���+�w+<�F��%p� 19j_j��`B��� ��~�ؚ�8�:^%�fO���u��$VF����`@d�sx}��m�}�&gM��C�Vס:-y)1n�}��8�>�P�:�����<�pǜ4`�I��\�J�.���Hė�x� 'Ч�u��Z%�+|���������so�4F�����pf���e�j�hM��S�f�: �vܒ���S 2��9E����y/.�h����� e�Y=4̭�o\F�V��T��$,9;hի&�2b2�u��~�L$�� �_cR�F�˹�g]:�8�&��Sމ �f�h��D�\Ŷ)�Jw�/��,���/���[3�M����܇Ƨ��c0� +[Z��������ޜ#U��O�cgi�En~ӛ�?#��-�^��i�,�<�ѯ�>�Va1U�oV�� wZ|~��C ��cC�@����?̧cv���cnd�����<��uE��� ^�T����Mm4�*�vqX�J��Z��-;BjKd�g�؟�=[e�����%�ݴ��(0���`��N���c�k�Bx��C�KXD�ƽ%���G�$d����� �����&`��T D���[���G�*C1��ԅ�k�'m�� �\���a8��8Xf�0��Wl.2(��m�>��Ia�/4�����[]�����\�,&!�ݎi �E����D���S��M�TH,0��=(B�ƻ�T�z�˒�,� C�X\FA��U� u�1�ީq�!��Es~ev�ɷ!�;;�t��4v��L�������p�Ȩ�(f��?CDު�bU+�k*�lo��"�E0ie��Ƶ�I֒Hm��������O?\��}�E��� �NƇ�-��[Փ0z--����M-�t����@m]�ؙ ���e%X@�l@�r�r\9�MP�)Lyۥ*��tq�☗ދ�D�ٮ/+��XCz ���՟�C q�0�~�\"r#w��q�&���+dl�j����v�� #ۯ:��!��y+/����K`���>���$xjZ����t�����y��~r-�>�؟��d^���E:��U��IO6Q$L�.�$���z��\��
Behavioral task
behavioral1
Sample
5a9effef729703139318a5bb90dc54e3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5a9effef729703139318a5bb90dc54e3.exe
Resource
win10v2004-20231222-en
General
-
Target
5a9effef729703139318a5bb90dc54e3
-
Size
5.3MB
-
MD5
5a9effef729703139318a5bb90dc54e3
-
SHA1
676b21f304975afb13d7e1538408f26350c7c68d
-
SHA256
e5d840c92b40dc4c93f6df80daf4736187f873ded9197d316e68378eb1b36ec6
-
SHA512
4758f20770508a8248916f0b37c4dbbd3499aa403b2e8a237126b9849df9a2fe0177926d4f778f128a75e989b1a55e39ad0e27594a3883f74f83d283bc1c86e3
-
SSDEEP
98304:D62xBh6afTTnrJNoTUDUkx6N5NgWKGFISM/8Wdpv:1xn8TL06BN08Wdp
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a9effef729703139318a5bb90dc54e3
Files
-
5a9effef729703139318a5bb90dc54e3.exe windows:6 windows x86 arch:x86
83ca550266742f272080f2f63c43fdea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
fclose
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
kernel32
GetSystemTimeAsFileTime
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ