����yK�� i<p&H��j"�s��Ϛc�Y�GWI� W������3% SJ��AG��OGF�/$��(�"��ИL&�k=��Jo���4 {F���������-��ɽ��O�ͳY�g�A���ra�����#�#�ZN�a����� h�|'6f3Z��ߚyW >:��ϴ�Žگ�{q�u�P=���nt���31I8p�v������`��iN��}��AǓ��-j���<��ɚ^�5��31�B��3�[�?z���'ߵ���;gU+;z��ёi�?t�]��:�@����-�o���� �6 i �P"�<'8�^��+V4/Ɖ�ȹQ�.���P�`�*O�d>��&|�3kP�f�Y^�k"igc {�Ó=����qq�2w�U_��$��QP篯$��W���ڢ�Vajָ�X����=�<%QT�O� ����$�[rʄ:�W.���}��*`����GB��5��e~�-fsJ"�|C��iU�LY�D����K�e~�H���h��X �x2��z�����[�`m���?N��ﯿ-�THk䡀��B/�fW�f���o�q��Y/ Z* �_K`Y����[��ӗ;W���0��Q�)#�a����1��%`�%�B��C�=rƉ�o�r�,Dw��f�+[�kX&��tY�(���0�Ȟ�Z�����v���#?2�_# �6<��W��`-0c��I��� ����ʺ�0 >�Q�4�|BnfF(�[^kh��-�B!� �^�muZ�J�%λ8X��H�ZI�<��8w��U��g]�Z'8��WûO���5.����!�YK��ƽ�#l9��~ ^���Ϲ�S ����i�6cW��>���+B��C����:��V�Hאu���l���Uo��� D�bu$(�� �_�ج��Iv3;�Ԅ�=,�jkk�n���5)!�-�Ӯ�C�{\�̭�҆�[�kͭ�'�kE��� �+�IB@De�g��������AX�z��,D8*o<��EN/�����.?��%�G�Uw��s�w^.S7�P�~��͉�kH[~�O�̡� �Ej��>h���ռґ.��*�BZ��zW��ņHcF��O�c=or9�I��ِ��e�E/� ���o���f=�(?>7�{�7�0��횹We\�,���p�m�4�����֘�� ���z�:�c��+�p����pCKD+��f��`%�>?*��-�(אs�JH���{rE�`�t"Ο=aʚ�U��FU'&�g� �0tĸ�+�eJf�X2z"3 n��EC �^����?m[����Th�,�-��=J %����Ȟ<&����l���w�ɕ��eW�S̅FS,�q�2�]�G/ZކC�y� I��t����O'�u����Ru���B$�_��hs��Dג7 ���3��`\]ˌI�goF�J�r���*z0���e>:�4�������6�$���Xm;��RŬ���@��(y�;�q$� ��cl�9�oʪomUt��Kn n���n D���t�_/̜~��O��6����Qqɉ�>�E� M�獑_��XK�RRF]#�!�懟�����iGX�-S�����ҌD�2���n]�.��ҟx�r�ʩ�}+�O4 ��|��~OQ��:�¢��P�O���,�JwAK����B���<�oj�a���R�P#�s�|�L�(�õ�P����Ȯ`+�8���I}כ��+��l�.�� ���ͥ�Ӌ)���n�W~O8�榉�4hӧ'p:�1�b�$?lm_��au}�w_I���@�^��NF\��u�[dG���~���Jb�����=*UQHe=�B�X�b ���������bbz��������\D�?�I�)�2�}e�=j��������_9�B�Sth��B��F���?T�.&M�T�f�=�ة0�خt@}a��U�$��/�����f��;L��d)��^��ZBg�<Q�ooz�����Խ �og�[������}��Ns��!)f{�d��J��p�������oi��OcUi����hf�K�Q�M6�]��_�˪4�����+X�0T�<;Ѩ��j&bsOAF�g��\��b�#;�2�#��Rd����1�� ]�k� �?������~��_(�b�Q���,�����.�9!�:pd�{W�g��������:�!k�_:���5�X�����'����XF��r��>��VBw�_t������<�Cd-`��� �T��\�ŞC����P�[�j�iv6�q۩�$�zxm_=���J�փ�T1K����N7aG�5�K�"��IwsMY]���ey�U�n�S���ѷ�h�~6����R�{K������$�K����͞A��,:+�pX�"����@ �Л�~�Do�/�ctPݸTN�a�= *!�q�O�o�n�;��ԥ���og�8�5xJ��D+���D\1�Wm~����Z((�I�G���)>g�3�'#��jv~K]��y+&�?=�c���}�0E�A�L=S�p< i#�r���E[�nz��8-W��*GKZ𧄛�SuƮ|D6���v�2#��`}�DK�%�$�?I�c�q�n���q=�� Z|a�S[�8��2f��`����2N,�wD�' ���fx(PpP�4���#�K��%�ʢ��cSB�n�����4� ǰAҭ��^�xY:]|�M-8��űYx ���� �;���XtJ�7�JP�X"h(��\K�U��+����[a�%gaܲ!º���E��:�h��oҴ?��\$��m9���\wt�=L1��� �e=�QH���x*��iʽՅ̸i���������<D�L��;;�h����"��t��?,��_�7���#i��@����$��>�XڔrR�����g�(�]�\�=�qp%��]_6<�X�x�!�j�:\���Ԅ(v �\j�e͚��1߶͒1�% YW��M;��GRb ���*�x��! �VB ]SJ^�����-�@�!�`8K��$��ɇju� ��uK�z�@�:�=����՝pr�9�{Ae��l�i����s���<�b輄3{����xy�ѫ>t�_��~�s��O�g�T��y���
Behavioral task
behavioral1
Sample
608c86f827f13b421505245786949220.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
608c86f827f13b421505245786949220.exe
Resource
win10v2004-20231215-en
General
-
Target
608c86f827f13b421505245786949220
-
Size
228KB
-
MD5
608c86f827f13b421505245786949220
-
SHA1
6ecadab13464212eab6cef63352653dee524a4ba
-
SHA256
e0bb5b3861ac8f74d7e92468c9489e772f28522e960ff34561e7cf1202a221c1
-
SHA512
a9bb1de106cea21549ed04b9430995ccc572e321f376637c34978affbaa59ba124140c682ec26db4e9bbb8f419bcf12309186b01b70d3e5a0eed7ccfe4f8a486
-
SSDEEP
3072:Ky1zVIK2GWGtks1sq6msXKbyLXDGAWRymIzU7q8kTQzGEzfsMph0s8/IgjYJ:lCGWNys6bWGA2IIKEzE6h0TY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 608c86f827f13b421505245786949220
Files
-
608c86f827f13b421505245786949220.exe windows:4 windows x86 arch:x86
8acaf73cdc04134d2204c2e122a3dc46
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaGenerateBoundsError
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE