}�e�]��V�z���l�ĢEW��ʈ SѾ�D�K��[��MS[+��5: �v�.)^��ާG�@�}7����=d����w�B}:k;~����C+�j��yw� o�O1��`#K��1k3���u��JZ�4w��l:��Zs�0R ����G�`de@�]�pW��c�)�d5�XX*{ѕ��ﱀ���"�_ffX{�+=��sH������Z�����\��BÐ�+73��o�^��� o� z���D01" ���&�� zW�Xձo �~(��2�/s��&�b�����0�����f�9z��������,n䬀�İ�I~�Eq��T~�2mSR+|�0v�b]t s����_�����b����q��YNȘɏ��2�ǃ�M[�WFE3��&<��{���=�y�s{1_n�� �ɖ��H��ez,���[���U#�� tk "�4k��0�5����Օ�:�T�Ax�c�nL�P�$u}E/��Jx�%+�����a��n��m(V���������f�)/8f2UI��0�\WnH\O4{BK�ςnl7�Yȇ�:KHoV�y�X��i�KǬ42}��}ē<�p:�>�HD��$a�\w-�.�q]b���� K���Hּ}����l↬V����~�)J �Z}KRo�#���Ƌ�$.�QU�F��$}�h1|�dX ܥ ����;6_����*B��bn�K������?���A���e��\em�M�b'�r�A�8�X��ۡ��Ẃ���wk}��z�T$f��da :�~Z�W�p|�f�y�ko������m��l��~���p��н"���������eD6|7�i��_zR�6@���$ ?K?g������B:�?����6�SX=��h�'p��2xs%���O壴j�C��--������f���6�e�o4+B�� �v�'�X4�1hD����(�H��E͚n���A��eԊ~�[&ã�a�"x&+��if���i�c��!Jp�F�>D=���jT G8�f��"8���뻖<u���FVq��ʎ���.�l�KRE����� ��O��<d�h�����!nĠ�3'��;X�o��G<k���ttK��Mo!J��+����0��+��A0�\��Uݼ*!�)�R��u�U�E�[V�� L>,���ߛ�5$�nn���/��8��6��#��-mr�0;X2��=�@4��fV6��o�o�hd��U���y��2�x�����v�]�e�N�CO�NF��TUo���"k�����!��}�e�` UXF�X-l�/�̽�_��� K��[��}頎 Vz����Ä��V(�9��Rx�td��9W��\TmLU[������E�4�gbP:?A�+��&x�O�O��o�0�/��3�]�����s��������U"����fܯ�Zr_3�QW�z�m��FP�H�$[��.������1���cA�@��"X,�@P<4�%xp�@���o���:����|���V�Q��S�>k����s�����D�F����$,hW2��~7�E����S�Fξ�HF����I�$�ꚈM=딋�E�*H�� �&�5���nșEi��1��Z�mp@1���:�w�x��<)���@��!R���+੭]�����3�^(w�f�\��fZfn�?���b ���7�]�V�"��E�W�gj�W�ƅVX��}�͚�i�WT�����|�[n�/�����>R2)�G�[�4u�x����7�z�����|�=ݩ���{cS[���y,��ܨ��W'O��M� �i�v������,W�؋�ݟJ{2���V�0�U�7���:Uya��~v�]��� -]���{t�ڽ�X�����mP��]�co�Z[)�v�s��y���Q�`��f�.��Z�"���V0( ��zE�3@�����qY�N��[�nF)Im4:^��{O�Ofs|����&���U�bO:���Ŀ'���\�@g+&��� 9u�wǪ�g�G����t��Y�p�����hx ��l����C�K���eE�;s>� s;7���V=��KG�<�?�Ԧ�S=:�6�"8O���-"�OȨ$�-����e�.�3F ffjTR��PMׂ�j���u�~\����[-�?�+@�����~ź��)�����(�������:��0·$��MGC�Eí�'��(��:-j�AmOD���Cc�LT��z6�-;����w_1��z�T,�x G>����]AQ�{����4"�j[\���kf(c��/�@ިr E���e�j[@4PѺ��Ր�G���p��A?lw;��^J�/��"�����"O&���y:��G�����o��� �$΄���8'����ũR/=��UFm_���0�$c��0Cz�m�-�� )Y��˦D��M:d��m�ö�֯����I�(M��2Ҧ`��ƊJT\����<Hf8��eZ�Z�N����T�*l��'^3�q��]���a�z��b|�b�G�#���8j��Q}̍��p�����a��r[F�[8���4%+��s���kG�Ƹl0�|�dz����a�J�NX�3K#Ǡ�f��� ���7����V�= �V,�W�Ɓ�����A[�/��ڰ��P'ȭ������zj÷O�߲\Z[zʗ�� �SJu��Of�$�ߏ��N�������T��!蠯R��cqt1��I�ؽ���y����w��B�2F�vS�~7%�~?ȵ�!�)߆���ʏ�2 î�� �'kHX�;s����%��PZ��msd��oP�3�}q���w�k�f��h�oR&BKA��1-�G����FcIƶo�4��͓�����}Bn� v)�_Qn�4��5xL�s��.`��� c�\�"\����l��y⡂@�ȟ����2�$��?�0H/F�cJ ����B���#��#�����^9W��Vz�h���"�l�fZ�(X�)͝���A��k-�Q�XJ����J'|D�%��jV�f ��T�qCl�B"�����\�I=t:���<:�_s���3�+�.v��r�g�w)���� ��7E��J�.�>��ƞwا[�ժ½i\��V}�D��y��ء�=
Behavioral task
behavioral1
Sample
034d02ce4f2efcbb10918ca8f66f56d2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
034d02ce4f2efcbb10918ca8f66f56d2.exe
Resource
win10v2004-20231215-en
General
-
Target
034d02ce4f2efcbb10918ca8f66f56d2
-
Size
124KB
-
MD5
034d02ce4f2efcbb10918ca8f66f56d2
-
SHA1
1459bd4c5eb454e8559b317243f34bab4916983a
-
SHA256
e03c0b796cbfe106d5f9513cd6a1b12277459f2090238555ce8e898be95359e2
-
SHA512
24147d025b180f02646ce20b17572f69edc16cc2529d3acc225ab96b6efb5caa6cad81968a5768b533bb1e84ced39834da6d406ecf503f486bf1b06231cc3504
-
SSDEEP
3072:OqbBmm2fTh0vENWy/zMd0BY11JP9dD30L7:OIB6fTh0vEsczQ0BY11Jf0
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 034d02ce4f2efcbb10918ca8f66f56d2
Files
-
034d02ce4f2efcbb10918ca8f66f56d2.exe windows:4 windows x86 arch:x86
8d21dbd9f6e860c82af07818c5319755
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
DrawIcon
MessageBoxA
mfc42
ord1949
msvcrt
__dllonexit
comctl32
InitCommonControlsEx
msvcp60
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ