w}�� �0��� ����j��v9���R恜H��D7 ;RIIO[�P����{��ֳ ָڙ�'J2�T2!A��Y ��;�@�����R�C�ѳ�N�}�ىS����VK��i������a�G�&��#b�ɐ�M �oq�jmkGm{�_>� ��u�� �4FˢN��U�f���"�T2���@m��f��ߢk*�4﮵} [!����������ְ����˰����z���&�74���Uk�G��$<�ot�����QÎ���m��tO�tW��,���K5raw�?��R�pbP�=���n��Ln�gSs7� ���旚��zP}��倰��L�v!ڝ�����-"�u�KcXկBd5����U�������������C�$"��?֊q�F��H�v��t�J4{e��r����,\�HX���>�Jٿ.s�0�%(���J�9Ȯ��2]���^B5�����Zpq%���<!��)=��Fh���.�)P̎�ب���n3����IQ���d���&��+����tt]�?�Z�'�8���>�� �G�s������]j&m���M/���_�l���_�3V���Lr?��M�9��}J�8�+�����%�I��#EV[���i�3�㯏S �i̮+8�lz5'��&ɹ���7 &�p�M�u���ߌ�rv/9� ��y�([�F�F�Frm����mWÅav��:���|b�Om��x��01t�U�o�*���-���W5�Z���+��B�ޓ�oz8;m �2���áݶ-��u�C�?�w��ݿ��d`��E���C���SWkL��+O5�3}�Q�(�_G��wFvi�^�_�(0�h�E���}Ƞ����F��E(� U!��$�� �gY@(���Ԝ�i7�@Hi�����{�ͮ��{h�$�o^c���1f^ �q.3����B����16�^��6��L��~N��B �- <��FW���g�c�*)a�hn���Wv�*:9-��~J\AA����i���j-us���;O�X�|�xV�A!Evb�@��z�%v; \�Z�μ �������'�\T����6��y��7�͎��-5��z�]B!�}�V�~�}��:�Z{@��֎Ղ3��;}�_f.qY�7��vO���W��;?lҲҼ��]g:bEc��l�b�G۵�h����4:M���B�fR'��W��A��~� �ƅ�*��T�Y#Cȓ���Y��g����'�ɕ:�@�Î⛪Ė�L�Y��F��E_rq=����bm$������~��Cu����-��l9����,߅��P�(7�Ǎ���/�����W�9�T�^ P��Sj�V�8�g�֙C箚�|�]�dC��$s��EG^���=�������{����=��n��&ȃ�Iz^�W �ʇ����{Z8h?gw�"�,D���Ӆ���b���>��"�^O~چ>�<�&�5��o����ciN���� ~���6���w��C0��ͮ�a�AF��M��W>�A�8�t�5B�bJ�_�-��O3��Gor���.0�B�!�U���(p�5+� Q3hQ�X�u%;'!�]8�R��k�K�������&��C����o�Ռ�]+�}Õ</ó)_A���,�N�n�*���^���;��_ym-�Pm }�������o ���Kp0/�#���pyf�����؎�2�o@%4N]A"M@�i1�����������R.�f����@Ct�1��Vr��5�,�r�I����6G�̠�< m������,ȷ���wt��jWi+4Q�q�8?��������E���*�Oxlх�:��[�A$�����7�RF�S7is����e�����(25A]�F�U-G$�^ ��$9�&�W��r�A{~іy�y��i�ԡ;�h��+3�e��&�47�iU��'!����ɋ���nI/�?Oc��Qq�H���ᘻ۲ꮹ�9V[L`�}���(�0�(C���6 ɫC>+��4��BV<k���U�p�BR��q50%RJ7A4�� ���tb�b���������&(����4t��&d�,��xG����;�@|��^��"��|uV.oq��&q�J��}L�L�h�(M�қ���U� ]�?�@�w���c�K������t���) ���5��a�c *&e��i����v����dž���;�Ҥ��ڪ�a�n��ʃ�n�q�i�k}�� �Tl���.�T��L��F@��4Ȇ��*2z�aMz�vK����vj���(Uo��r��mfF=�;����3�>�)�]��Ժ8x�=��.����������@�R%�+��D�N����ZA��B��O\!�3��ǯ�TE�&��岁������zX_.� �v�1?tn�1���yK;�pիwb���ئ"�1G�7�������8'�gOp��I��Gl�wUĆ^Y���2�P�`0����&o�����#˅�ZD]%�5ߩb�����r�i��`y����)B�Wٴ��F�ׅXw�@��6��>^Q�+� 8����oocV�mD�F_]�5m��V�v͠�T������gA���� +Zb]��%ٳ���X��������1eo��E���P��N��F ������|�tt��C��Z0�K�n������/(��J[�Z�}wF㏗V���p*�Mz���B���ݍ��J���0����9�a�!*/���������ob���`�VON'����HJ�~�B�QtYU�$e� ��t�X6'VFe,�*�h��&�V?�=�V����}�C�+� �_h��Dx ���<�>��,�d���$C����;'�Q�q�/�Zm�fuq�� d��7Ir�Zv�7��-�1�_�@�<���Ry�}�E�)2�/6�]e��e���n#�-S��5����e3���&�54�r�ܖk�W315E�����`q?�5N�V�Hf��M�8�(/Ǚx���ѧF��6�z5���2;�r=>��Rce<�!z�"�/��3��3������I7.z������U�>��q��RE��B+k�'~�+^Vt?�����@�5�qjS3����v�bٲ��6�
Behavioral task
behavioral1
Sample
0aef50e924c973c9ea7b15db76fc88e1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0aef50e924c973c9ea7b15db76fc88e1.exe
Resource
win10v2004-20231215-en
General
-
Target
0aef50e924c973c9ea7b15db76fc88e1
-
Size
239KB
-
MD5
0aef50e924c973c9ea7b15db76fc88e1
-
SHA1
76f0b1adedcb214ddfaa5db246679d4d73291605
-
SHA256
1475bd0eff685b59c7c5009681e24391ee6ccd3752de4754682b9ac7f78074f7
-
SHA512
fdbee674e1b646e0b003b200ace3315a45dbb0f01f1a5af3fb7f6f57d3d267c23e90108679773391e081c10071d344b703c2d3e9677e2a99ed42413b6c989d94
-
SSDEEP
3072:O1WF3qHub4SqWOz2uZTDPJyUOa4ZSFll/7meqdS+8OmUmlexnKDHVAhbNLvmbf3:OQFaQ9qWOLAFayShmVSS68xnKDHKP8f
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0aef50e924c973c9ea7b15db76fc88e1
Files
-
0aef50e924c973c9ea7b15db76fc88e1.exe windows:5 windows x64 arch:x64
8b53e9bd1d9ca5388915fb8620709eff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ExitProcess
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PostThreadMessageW
advapi32
RegQueryValueExA
ws2_32
WSAGetLastError
dbghelp
MiniDumpWriteDump
userenv
DestroyEnvironmentBlock
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ