��j^5r�T`a� ��7���*=|����&3=��ƢG12���(��m|�DdD�͋6g�٢������Zz)��<�����U�i�8�W���@�����@��~.�����<o\�^��'�p�o��D��D�L��;��P��;�l;nQ1�v��oo+o��0��R�ϗ�*�I�����,vN�{#3�`�k�&���5 w����D���9LC��T�S�_f�)�5�m����(�h�*O�7e '��wKC��[�w��s������BS�����J+��m�~�5T�ƞįj?B���Brj�ғ��:�a��}��k���FR�ܠ^�bJ���~X��Q��� �^���Q��<�58,����5t�i$��%��$�"N*)�e*%V�e�?��ط��r�'��ꑓ���\�rc�RSO�zا>Ґ%s�-m�gv�������J�tG�m���Zo��� ��!���L�e���Q��\0����Q�Jq�Ϙ����@rǘ�S?�"��%�@�&ԕ=]��2/�����{zo�Ř����]_��l�W� �dMH��|_�w�����������&�'.!q�o�,��C{{&�2`]�ĔxPdԹs�9W)���`�dl��=�P'\#%55�<����#Y~�X��p��ˤ�1�K�*�n���.��F�-V�6a���U�j}T�N����Ҟ�l�� ��} � kl�%fg���)sRT�O�Bܙ5�Dо����L��ܩ���r`67�i�%7��h{j �lo1%'&��8r�����AcB�|�N �&��{�ޢ�e�$\���>��w�X����6ֈ��#����UKO8�8�}�4]����x����p:Hy��b{N�-�~�#�ka����u�`ّ@�<� 5&m�P�GL\���gl�\q:R<�V<&� /+*W�@���`���z'b�ŭ�Q r�8�٢K���:�k�����Pm�o#تx5\F� ��V�0�(m'�3MWa���:��OQ.c��^O-���B��;K�' ��X|�I�ŭ���於�-� �u�^�?"��Ğ��s�|5����N�Z �v�&��KtS0�<�=�fBq�Y^��J��/u���Eﻑ�!�nA쮽���Y�"b�B��M�����>#rA�b��lT(���c@іG����;9S�RF �Z���^�[�]���/;P2�| ?Po�KoCuN]fϻ��{|� �k�Sh��3ObJ��Rr��/T��"�a�� A��,�~i㹌iU�Ft���ud�]�a�;�c�z1Ӈ^��|H��@�dw��kniG�ꖍ*�*M���VpΉ�nht�=�'E�����j�4OM0Ω=t���Zt�WW'a�&\�V�,Hy@��[���.�2�CT����q|�X���0u�}�qEX�i�|H]K�O���|!����y�0[�����$Q< z���3������ka�0V�Fl� �OtsT�=�R��G�v�q�A�Ћ������_�u>�YM�����tP��M�ߙ��H�Η��DzM�;��l��ڑj �S��{�oJ��bkn��P3{ 9.� ��~c:Y:�gr��c6�}����^S�����Z"� N���)�#0p2`����ː�YhuK ��!?3��kDb��Om�Anvp_HBq�Mn�����.ʶf{��i6� �%��ZM�R�b���9Q ��P���Sl����uy���m����l=7eZ�L�بZ6(�66���}�:iR\�Ŷ{��^ĸZYM�k�y*ǯ|�G��Z+��)2���� ��R�[��8O�|:�'��2��A����v�Z0`����������S��/���lp��[��x��w���;/�`"��-\�8/�Vp�3�τ���y�y=.sjg���R99K�ɺ�s���E�9��.�6�M�oЍ���O��S�p�b���5��.��2:��Mxm�5J�=W�@-�/��Lf.<.�J�����2pp/6��z����G��S�Squ�c��?�!���/��hI����Iӛ�&As0x���¸����,%�U�*���M�S��sh���ղ^ m���������^�_f7$�s��0�%����na�F���})�<�Ʈ�s;<���p�͟�{��j2"6�W�"��G@~W���oX��:ҥ�F� 8����-o2�ʞ���1�͋��(��V����i����5�o��c^,�� �3W� O-��_}ѥS�ڱ�Yr���I�����J�l����6�z*��PUv�����)��I3��T*O���^�-��gp�)��-�K���fo�B����U�3�a'�T�������~���G�Nz�<q�,���g�\C ���:Vu��V��W���9�e�}.��r��J��4f��������b,������5���V5:vh�KeD�h�ʫ=�\��jYs�9n��0]~S�*]+� 5r�|.��¼R^Q<� T8�� ]�����m�Jb�'��|Xi��w/���#�.F2jͼ���S�K���tvr�If�f%0H�yj*� �'>����(�Cg�7 ��rxj=�C��}���ǝ\����(�I3E�U�N���}�A�G�/8E��e���0��$\�N��F��͒5O.��G1�mw� �t�Fʰ����Ȅn��S�[ZO�[����f��rak��l��˜�WK� $]��Ê�q����eA ��k���`�^����aȪٸE�&�m �]�������)b&����%%f�ND_d2�Ń@��w]v.'�(��!W/(��c9Z�Y�1V��z�j}@�V�!k�Kf���\<R�4��2���(n�T8��ʰ�x�&nݖoGF���5�𦬺0����ʴH�K�/�W��7Pr*��-%g)���~&�����k���g�L��F, �ǝ[%��/G�p�&O�����m�Ȗq�Mh|6������lߴ��@��F_�D��������� Ԅ����v�����-����"��1�?�������: v��b����:�������T,�>���}C���7�����ۍ �pm�U��fŗ�
Behavioral task
behavioral1
Sample
0986fc97a069471628911b48ecfb5bbd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0986fc97a069471628911b48ecfb5bbd.exe
Resource
win10v2004-20231215-en
General
-
Target
0986fc97a069471628911b48ecfb5bbd
-
Size
6.3MB
-
MD5
0986fc97a069471628911b48ecfb5bbd
-
SHA1
3ddcd3af97274422710b7c5ccefa1db2f8210019
-
SHA256
d8e70d23293c2762110b053c035326be1ca651aff559f579ca0c4def2bddbc3d
-
SHA512
acc21041d3254ecfe16e19aac710e92bb38608172b9dd160f918fdb7fc1ee47d4d7fd10ea0d70b61e8d5b19993d3be706b359285916fa7e5c1ee5e6d590cc706
-
SSDEEP
196608:2CUKX3w541kiqZTQ3DVk0b/U5T0/2XsH4:2CPXgXiMQzbb80u64
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0986fc97a069471628911b48ecfb5bbd
Files
-
0986fc97a069471628911b48ecfb5bbd.exe windows:6 windows x86 arch:x86
1a311eca9ff18c0038cb5adae52081f7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
WriteFile
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 218KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 786B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: - Virtual size: 4B
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ