�8�+�O��Z~����)bJQ�c�F34��i�@��B)(�'�j^�l|����������M� !�6�a����<�U����U7�Y\T��E�A|�ص�vhg�t������v�ȹ�d���0��ݚ$3ƧՒ�2*�?�:���B�0=�\�!F���8�v���l �çdU�8�o���fU?T�@:�09����h��h����&�}�Y�3�76B<Q3`���:��Z�D{t<�pG�q N�U��4Ք�yi� `�C�(և���ldf�n��u���y-����'z��F��8�����7��îEA&�]�����[�a��y���Pkm�[ ��%��7H���v�D�V(!;��m����� �v����g �Э�r6�o�]���'��³�?�Y������M��Ş@? ߅��N}�n�R- ��0�g�Xc7Ţx9��j�7H�z\�b����oV�1�E{��fbx��n��b�@�g\�@lvZ�W'��P6�Y!�!���'HbƢ�d����S�E���U���~�{�����1��� ���S���%üϾ|)=��aU[`�DQ��6�H����Sn>�*�҃��w��J�(���Zy��Q8TQ� ��f�S>���������F{�w� z��3]��4d݉ Z�.�J�ˡp�Zѝ���wa�]~�z���{��Ѱ�]S�����OS���@�n������"��'V�������;��2������FL���ae(�S���M�����zJ���2&�?YX�xq�RsN��Fb�Ṙ��9����ij#i��I�rҝ��[� F����^k��5��W*nIl�Ɇ����-�|d�����P|K܌&� ���'~��#��d#r�[) ����\���C^^[��[���?Y�)�zb��5�����bVL+���ٲt�`�� �� �L�t� �:d���(��9��:�Ģ�`������J�ob+Q�g�|�X�,��}(�D��I�� B��=B�OG�*�.dY/�s&6?�;"��3�L0�Έ��YM�a��_��������E��x���b�^�"��HM��+T�;���j����7D���}�}�:�!R��(s3�-��g � ��%%�Mj����Ρ�����>��Z�p�F\�l���l��znEO��y<�-�6C� ��E��� �c�y�j����x�7�\bTQ�=5�k�ً\�e����u&����s]�D0if��ɘ����|�6�5�I�����C!}Q��+���lTo8r��qC��>W�Cm]����,Ͼm�p@o�zz�xO�F���;����WF�)H X4� ����O1j��c)H��Z�2�����42�E}ph���fhEY��x=B��5��]F[�F6ǨBc��1H��G�cUV xM��~��oH���v�.�������k� (�)�,8b�Ƀ�DEE�R?j�c�����j���Z��%F����J�2e�K�����=Ӂ vi���ً ���|���� �P�;�r�_�~@���C����T�$$m/ɷ�3'W(���Y�z!��� Fy�|���Hԛ�il�S&G������qb���שd��βCZ�`�ؒ��&˰����& 2�!P*.-��Х�g~¬�-���'�h��*(��8f [K��&��s�/m͗D��)���2����QH^s ��<��"-@�Z �1>��m_�:6t,l���+P�ߑ"zZa�N$?�y�I���z4\��@dY}k��~$��]�T�C�D��?�ey���b�`MZ̋���b9cFOq @Z�u{n����@~k���,��x���\������/�8dՙ8%A��w|MQK���7T�@��-%�e���Jx,�.��%vBθ}S�����}f�t�nʂ��h��n�˪b����t��}��l�%6�W)�w�M[k��$�S�wxD��j @f)�ٲ[li������K3��G���poCxK��X�zP�{}J�N$��<5�o�������9��T��+W��}u�+VF���NT��w'yT���98�ڛM��� �RMC �lE���v�v�VgK ��B��ųB����rOT��O�tб�"y#�bT��Q$�z;�ԺTs��āx��=�����!.�;XK����G]�x9�� |~���&�/���R/�����]>��ܮ�����7B��{Z��ᗙ�Hq{��� �k����`6>���XZ��$��(R�n��!���^�I<�t���e/���a�>[�K���7�IP/L�g�]�h����#a�x�s�����eq�˂J$�c��� ��G1����ӄ�����pjj[�"]�Ʊ�*g��u�1��[���u���jrg3���,�8�m��u��un%x�| �q/1���bNt��_N�?�ar1���TwD�E�1�ttO�Nц:���^4P *!a ��>��)��E���Fp�˻Z���|�'��r���������m^V.T�J��4a����-���tM���Y��[��!�0�|�~����La(���Pe¦��I�/+���m�Ɲ��4��;����Id�bQ���c�P��̟I�������R+�F;as�9-T�.�HXw�z��%�b��R�Yc� A��`Y� I�����V��/����ب�j�%��N����������zrt��F�|��7��<����Z��cFM�����N�;��_k�f�+Yɋ#����곁Q^ނ�nA�%����ò{�=�W``d����[��)�RP�R~e-풲,s�>-��.�|]��/^�i��r/��)�M��舶��S+rL۳2�lJ�����A�`{8��Jw�c3,�$^���X���;��G ���|�SlUbjQ�c��C�lT%N>XW:RxJ�U��@_��u$�z�Q����i���ՙ���������������D�^N��h��]�ߓ]�h*��WR�7��>m�S����� 璐r�8B���v.)���̙Mº�������tT鋚s�8�,eD8��{�K���P ���P�?Q�r�Y�
Behavioral task
behavioral1
Sample
08b92cef4d8b75a3a9601a6576821689.exe
Resource
win7-20231215-en
General
-
Target
08b92cef4d8b75a3a9601a6576821689
-
Size
1.2MB
-
MD5
08b92cef4d8b75a3a9601a6576821689
-
SHA1
e481faae03116ac4bbc1c2fbe5514ff56a058920
-
SHA256
e1e77b36051be759161937a4f73347cc332e10899dcfef757dc34a8741631daf
-
SHA512
1d1eb45a3cd1b58ae8dcbbd30a089b7a1f8184b2bbf785ddf7c122e36bc45879b80b9d7140df0ed1df18be90c4601b96d0aa338b47200c3abcf7d5e7b24ed7a6
-
SSDEEP
24576:oOFvGI1AZJ6k89PykGYz/hBnbjpq0E6zOpzc6EBi/hcWs28myk84hUY:oYvGI1AEGYzIOWaYcFlk84hUY
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 08b92cef4d8b75a3a9601a6576821689
Files
-
08b92cef4d8b75a3a9601a6576821689.exe windows:4 windows x86 arch:x86
50fff0ad8729de51a36ab189ca9362f4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
WinExec
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CloseClipboard
gdi32
CreateSolidBrush
winmm
midiStreamStop
winspool.drv
ClosePrinter
advapi32
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CoRevokeClassObject
oleaut32
SafeArrayGetElemsize
comctl32
ImageList_Destroy
oledlg
ord8
ws2_32
WSAStartup
wininet
InternetCloseHandle
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 492KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 929KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 317KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE