�Mn�D�F\����$R�*�^��#u�6�^�j �j�u����͌�܄p�i����SK���eI���x��Er�zP�7��غ���̊�����O��X�a}<�:�� �O@�� z�_����* 4�� �[K]g�V�]����}�ث����T�g!C����y�椲��a@����7�h�D/t��>_�?�Г!�\��E7����.��`������l��-��� ot��0`��d��0@�г��y�x&�M����b7��SЬj ���x���h��z��=[�u ��DX�7��xί��h���Z��#m�Cx�c(9�����<n>l�$�<d%�Jg��x`�b�}���5�8�g/ކLJ�V�5`�"�0��K͂!.�h<��ZM]��/�t���lj�_�W�Fda�!SHn��:w[%�m�Q��m�f��Thir��KG� �r�X��ZĮ�PN�b����n$��a����Qɣd�\�� 8����*� ��S�sDC}=3p�]q~%�_�fp���GD=.|S[�g�)�m\|�SEyR���)��E@!������\=Nݓ߮��ѫ�'��j�{�t�Z�������R���[�4���M_WϢ����Ϥmj(g����pI҉q������d\��V��B���������ބ��*b�6�����L�[��4��&R3KۻK����\H��ʹ�Ҝ�M���0�ˁb��2�*�����m'�e�[r�3�����jZS?9�'�Ԡc��4y�(��a�?���MF�d.(� r�0�G[��:G��<�VK�sFXQ�yO�YK�e�<]F*�l�}Q�l�p�vؑW�m}F�i���������ۃ�c�V����k���!ޤF�1+LP{P.������q�[\����&�a�y ��8w�wI�y��(▰�80O��A��k��E�kz2� �u��RK���$�~��p��N�d�z���J����E�4�T�m�������,aKBpL�5����g)Ӕ�ұt,��5~6E���K�F��ɨl�H�G���9��Ş�����d�\�G:��d�X0%�z�pQ-����o[D����v?0/Z��8W��DD�:\r�H�G��~l���+!�;��s��h?n�~@�5UQMo�:��h�ȭ3w#��k�1 �)��E�ߦ�oh#J3~���0` ��yh��ʤ��XE���&F���o?�r��ǜ���>�-J�^Y����h��7s�8��J�0�,K��jjF\V#\�܅%�m3�§��rC�|���µz�0�D۩��c�!: �)S)�:(<eʚT��,������L_�A�mH��w��\�F��!i;���8�^k��TV)<�H��ldVB�+�HEM/��Zz=�8��c�����._�M=oq�--�?�����5�#v�f�fG�����[vjaP����3f�E��P1\H�mI���NA���Z�̡Uԭ��� Ӱ�O���_@���ND^�3������q�&�q�Kq�]ᚡ/G?W*2�bx�g9ߛ���-L�NI.Z���� .P�?�0[������� ��n�M�J$�oHeS����������RC��f�J��ёa�u ���GUN����!P���F�>���2�i 0�y�CFe��^�5�J���� �C�iՒ�Fq��!�V7�Æ���,!g>d��� ���bh$��>Z��Ƴ�y�{����/�9w����֝̅ظ���l�v���B�R����*�> rl��j�\)9�5p{c��X4;���Q�rJ'G��c�����5R-��z2-�B�F���q���^Pɸ�$�4^D�1���ň�"[\9��p/��6O9(29���L�d-j�5.B��n �4�m�;������*��X:� 3��tv�^^�+j��Z�l����f���h���R���ط�&/���ҡ��I�b�ig���ck��h��0I��i���5A�l9* �.�p��ȘI"�2o��� ��H��:[T{��H3r�^�'�R�k�!.��-�?&��)�����?D�'�#�I���U�z���i8|�7��T�t����V�y�=�&*�e��F�!eD9���}�J��$���zy��V� ��͖hT.6�}�]�+����+� �(�5��o0��?F���KX�a�ʵ� �Amj�����3��L.�:3'Ψ�ä#�|H��,?~vY]ާ6j�g��M��N�<;�A}n�����kV̦s���iorh}���Uw֪nj�M�}.(�m���q �T~5���F�����w��E�P�0J��I�0`0�x�0�ٙc�}��� /�9�<[�������9kO���%Ъ�e������^�C R-$��E�d�/���g�����DA��J*��:�/�ZbX��Zl���CO8�bV#]��!����zɁck(f+8���3ƒ�L&̧��ke��G���.�����dr��>$��!�uF' �9Y�����wM��Y�u��1e�nB�=��^���\�M |��'#0r\�J���p���_�������;`(t�<�q�O]<���Ia��H3 �W1]��N�+�C��5zk��f��3#Y>�ޒ�V}��c"�s�3�g��60������#���\ ��o���t����J7�n� RXD��c�4�望�s����F��2��|�7��#�'�3� �D���=v�b�u�.��x*S>Vk>��5$� S;�n ������Q�� ��Dĝ�gWi8�����Ѳ�����KУŅ�}�� B���Qq �uJ��wx�� ��9����z��Ɋ>��xa��?q���� �$��CA�����%(P��a�H�>��wr�6V%���J֤� r5�lF���)�G*�>��K#o�o?����C�?#Ky�؈�?��e])Z�����r ��&��6���SjT�v��BWp�;M���Yv|�\�e'���s!\_�Gr(��#��=��^��"����N��������#��`�t�ISBw�T��
Behavioral task
behavioral1
Sample
f7e8ee00d9afe114e83f30b5c8d2d736.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f7e8ee00d9afe114e83f30b5c8d2d736.exe
Resource
win10v2004-20231215-en
General
-
Target
f7e8ee00d9afe114e83f30b5c8d2d736
-
Size
6.1MB
-
MD5
f7e8ee00d9afe114e83f30b5c8d2d736
-
SHA1
02638d17b629faa222da4bc78e822cade3a23f65
-
SHA256
d3c9d0ce3159231ca3ebdb31635b0e181940acd6042ede056170816f6ed9957e
-
SHA512
f7dff2a5801de127511c79477d52899886de139d12a000abf90c49e8aa6af29a0799c2abffe6bedd5d0e54e686c2966282a82a47c646f43d8e6cff6d0ad2258e
-
SSDEEP
98304:mb+C0zGN52Je8hLbH9XKDqH9uKJoLKUZnxUfihsZaJhxrkmjMBITPES:QV0zpThLr1KAixOfMsZCMIo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f7e8ee00d9afe114e83f30b5c8d2d736
Files
-
f7e8ee00d9afe114e83f30b5c8d2d736.exe windows:5 windows x86 arch:x86
8b8d0aaa7ee16933ae2e688504f1dceb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutReset
ws2_32
gethostbyname
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
rasapi32
RasGetConnectStatusA
kernel32
GetVersion
GetVersionExA
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
LoadStringA
CharUpperBuffW
gdi32
CreateCompatibleBitmap
msimg32
GradientFill
winspool.drv
ClosePrinter
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
shell32
DragFinish
ole32
OleIsCurrentClipboard
oleaut32
SafeArrayAccessData
comctl32
ImageList_GetIcon
oledlg
ord8
wininet
InternetSetOptionA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 489KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 104KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ