!ͰUP�^_lP����b��`�bϽ��|E����+�-Si���vȈ&(�~��[ۓ����)���������3���A����0�|gmU8�=#'4��`�lUe���}@��XG�!��>,�CH[j6�H������_Fk�^?��^lq�P� K-q��̴6��&�B4!���ܘ���;� Φ��p��������B�ׄ\�Z����5����ه��,���-_�R�i;">ł��5�%F_e��쌽��[Ԅ��1���;�Y�>9�M7�E�����,�F�����N��eh4��@H���nj@^�R�+OR��)���Ve�W�T�l<�BT-��U�|��ݫ�������SM��s��X�5�uM��MqO��99��=�U��1LMB����@hF� �9�_H]���V�3�H"���h�� �C�~#�흙�8�_���m�C|ό8��]k���MCQ9Jt��^rV�*�O��$��6�ΰ�[�*ָTu�����6�Q�n!��+]zF�6���[zҜA��t;�ʐ3�-�4g?��l���{͕,0��z�^��¹���i�9 �J_��U�ڄ˘[��$F2 �x��Q���lp�nݠ@�|�w�Y������ˊt���9ɮ�1���y���MYp��/{���"��Mp�v'�=�7R�z�������1Jh��]�'��K${�CB.��G��TD����}�5��Ñ�P)��vڭ7�����z��ˁt;��ہҧ[�R��ӧd!X��i���hv���d���{:��Ѿ�Y���l���`d\2���mL~�Ҫ�H��������f�6sd��a��Mya�V�BbTk?C�n�="�����=�|��� +���n��\�(���q\�r�O��3�A�����.��J�AL�J!PV6��<*���u����/Wu�W0\�2��<�'&������f��,��x6� Q����`�X�Ţ9��n���Y@�B@���p�en�u^/���������.f8Z���%y��u����~�6TI�s��?ԍ���>S"�Z� �T)�T_�7�s�RX7�nQ�\�&�(x�� /D�j���-u�)�JWm�ʰ ���t����PږtL���]%%�>y����p���w�u�3���mi�l����s�x����6��R���ѥ��tl�]w��<�{�nd(q����ǽ2kO+Eċz�䟥2RaJV�F�P@/��#n�J��!VA�i2���wƛiz�,���.�^�&�o��r$-��9EC;���.�x�b�"e�<�?�xE�n��ݸȒ�O��u}�sq��ʸmZ��5�J��:��a~�C�۞↯GjV1)(�7��X��s;pYC�x�1_��R�6�1B ��5z:�Q�"��U.;jLk �����+����ڵ��3E>[Z�����̬LOj~�>�4�ĉv��t�wO+UTY}CׄԄgZ0�|éE �� 0.X��G���@�`����5�cl�-N�lL>m���|���-�"�� �F�K.J��/�0�B�<INX��w�~�;�I����M�q�'������{���}nU���W�wR8'=�'��Ho�ҷ:J��p?Ơ�f[�<�79�T���X�d�8.ߙ$�o�2?r������R $ԓ�S�����<5�R��tϔ�9X2k*70PO�vVx�5|z�9>`�vd��b�_+Rq��l�]'���C'In}<�u���8���3�����j�c��KTK�-Э���0�'?]�����C/:��[8�6�Ә�PW%M�,�ᎅ E|�������]����XrKi��� 3=rb����B*%=�#���_=�49Yڛ?ʕ���EtĬ46l�?�Qom>Ո��z�K������褥貘�1��\w��#��:�ߊ�ڲ ՞��C��phj�)�j�'08r-<�7W�q;~�^8>[N�$ �>�(�tچ�)����p��Z0�R-)a���Ǿ�r���G�:L{������v���.�{JP�]M�A���n'�̊lTD���엄�_Y�]@:,+m� ���i�D�/��ۢv.�lD)��^3���Ǎ`]KpW�F�%���֑O��F/%�V�5ڀ'/>�J�U�W����Ɗa���Tn���-�`!A�\�~N��V�� �ǐ��!i-�\�I�D��E ee��ؽ���;@MY����5 3Jnei��؈o�}<c��s�y�i��$5�Ω�n�}�ڷ'/_�a|��G��M����t�3�0qq �o�&�� Sb�H������<�{����(������3� �A"���O�ݛ9�7@ ��M��+������9�^�-����W�L+��a�,�S�+�(�䲔�\�/�ʍ�:�P�Ӿ��A �L���_O��c�c������̻���cޑ��!C�/VWG;�/_J(Z�0|��l�]cص���p���@ųk�O=�swbb���O&���lxƴ��➌��/sD�![ʯA�A �"��u�(��u��W�x&>�����&�J3DZh�}�Seix�s_��*g<�H�H� e ��7����`�zW�W����p4� ��r�un�d<�9�"g╥�i(��t��8P`SPZ�-���v�lW���%�Qv"�kz�^{�!ׁ����C�[XU%F�R�\���pC����8�����Sx9�LQ�U }1�m~����.��@t���-������(F�R��#b�)�Q�� Y��ѵʙ�?1��\ڎ��g�Ep(��|�%Y�gd��r��(hK7�ջ���X�l�ٰ̣&�rH�;�����+����� �Njߞ��M����\RS ����N��Ν�B�v!Ξ��G*���q� :�C����|�!�ἤ1�,���D� ���N��+Bɬ���.��(���w��p(u�X�ȁL��X|��pD���* ���������=4ɳ�3�A����3YN)0��I��Kk��yYx���9���l�Ǯ�}��� E����?��R%w�@�Q���>��#¬#���͵|Qghǂ-Y1]�W��%��' D�9\�6�Z儖w�a��sJ�;�U�
Behavioral task
behavioral1
Sample
5f6a558c6398d1de290aa6892213d04f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5f6a558c6398d1de290aa6892213d04f.exe
Resource
win10v2004-20231215-en
General
-
Target
5f6a558c6398d1de290aa6892213d04f
-
Size
408KB
-
MD5
5f6a558c6398d1de290aa6892213d04f
-
SHA1
3c9f1409f2d2aea60a9ee1f7199c0113a09bac82
-
SHA256
e79589c5c136b067c340849b435d530f8023a3d9f7fb56e1bc883ef4cfaab894
-
SHA512
cf0fcff17d543522e2cdd471ec987575114e2f3756215c0599750ced7c291cfd3b59880aa5ac2a74723f1c686ad9becd4222c4675438535098c7a965a35b5027
-
SSDEEP
12288:atjWnDi2x4Z7H0N+Vtx3OuzuOQNB9Lwd+:atjWnDLA0NSx3OUuO0qg
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f6a558c6398d1de290aa6892213d04f
Files
-
5f6a558c6398d1de290aa6892213d04f.exe windows:5 windows x86 arch:x86
894e66a03a65a815a4f1cf79748704d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
comdlg32
PageSetupDlgW
shell32
DragFinish
winspool.drv
GetPrinterDriverW
comctl32
CreateStatusWindowW
msvcrt
_XcptFilter
advapi32
RegQueryValueExW
gdi32
EndPage
user32
GetClientRect
MessageBoxA
Exports
Exports
Sections
.textbss Size: - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 379KB - Virtual size: 378KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE