06:�Z��=���IP������B�S��}Sw��@���=�1�Xw��`ӥ���O̤����$E�>C9`�E&d�e�l=J,�s~��P�� F���o�s��jp4ٲr�Uy4 ���'[˭kc�LQտ ;^�J��� ���Ec�����QdB��@����y�]�Cg��s�Փ�R��gX~!��י�`�K.���X�&/�F)|�'�n�-Q�F���p�R:��8r2۰V3���,���"b���J] �֜Ds�����Og��[�Wi(�K�g������+��1�p�sc�t�ԧ�U؍8��0gv$�l�Ӧ�� +��q쬿�sJ�)�ַ������u_IyC�̎F�G�LGnz�w�GB��2R��1Vb�GM���r�x�C������r��[:n�W�S�%�v�W�Ӗ�9(2H5R�=Ȟ�|���BΧ��m8�������5j�C����i^�,���)�����M�) ������Ṙ�@����=˨q�����Z3JG�t��������[��k�hLI��+U��<���O��|�@�$3ʭ�͑����E����ht�0�^a���4�J�����\�|*wl>�_��}��/ F6c��KU�m�9'{��;>&�1�i���*���%z�RCEF�x��^;�b�6��������r�7Iȵ7�Eyl���ݺ՞����nf��Hx��2���!�Um�9�9�l��4�P#<�q�U9��f�,���6�m\��L�� 5��~�c���y���:8���Q~yIQVt}_�p\�J<�(oE� t}�ȷ�ˁ�]aZ�p�`��Q������$�Pa�`�>\h���:\�����ν����aᷘ&Sb����[YWuNyb��� *3�w�b��� bw�ZH��(��E3�����������Q��J������V�u,x< *�,�3|9�LR�|�e��Ã���!(�ի.�V�l�9�e���d�M����?��6���Gq�!�}����T93:7?�� \G�K��I����@��W��f W!�W)/���?m^��&��@�py������ ���H�L�]Y��Y�ؙ�_�O���������~�T��gc�y�v�M�4s��y(��ڲ�<�P����)���~,Y.\�ň��#����Y;� ~���]GZ��E�nJ��0������z#y.�짷�Կ �c���x�xs�x����)�7�/(���5�� ��s�IN��.���m+�E".ifD�!��ּ��ݎ뱖��"qI�!�7{�n����U��Efm���YUB��� e!�������L\�M��ݱ���$^�i��u�-��.G�4 �B~/Dc��Z湈̅^�Lh����3�5=���4�:w�U����fO^ �C-���3�/k� �j�v�� �'~kR�nG2,�]K~%*����.xO�b��gZ�%G�.�8��<r� /��˂�KvX[��N:��k�w��>��g�d���t-����pR#j�}Z�]#��ϖ�}���/��c7I���E����<�a�k�Vl��X�� ;R27_����Z�o��?kH���A�m�*��l���3O.Q�����a���A6. ڹ�������U 7�fcf�`���K�ob�7�ʚ�+6̅� ���=B|aڨ��Ա/�m�����(�%��e�V���x����l�����5i�=��VQ��8F.���av\u�锺Ö���a��������"���Z�&�r1�>&I��i�i���!��e��Q��|AXa����9:���A1SK2�1$�3"�M�t6�Hޝb�X#,�FR��<M�-[�l�d)�q�j��f5�%��d�z��K��?ݮ �qGN�D��H{�S�ƽ����y˖�bt5^�m0 ��MBp��ܩD��3�W���-V���S��!bm���m�88r/W���71t�2%�ou�i����i�3ŌM����L!�=AN��¬�����]d��d9����vT�� \zg���{'b�z<�U��u7�o��&v�Xo���%����T���@�j�wS�}l�ᔭR&�!��%kZ�h���"&�4�o������N�S� u��4���mF���<һ̷t��Ԗc��ѯ�ՋϊA���! ��(֫�?�{ڳ4U7 ��=V`�-�c�%����ؤIL4����N�8"g�2����n6�ѝ6�������,�yTWV����-�$���+�J��6��ב���&dV��d����Z+%�x��0��m�0jS�1��v������j);cV�<|��Q�8�̀�lh���4�f�J��qk��� вb��*���)V�����b��Ǜ��!����QI%��w� ���|���>Ю�}bi�%U=�?VI������؝|�����H\��}M �*�����&w��~��!"-o (YK K��t/�p�,���= 8�?UH�]d� 0�d�V�4�ԫjˊY���l�"�K(�l�Ԑf�����PĜԙ �!Gё��DEѿ��z:+Ex�sl��4Qx�Uj��q�F�"冋pZf� U]����� �*������`ӻL���!�B@���i����F��ld�@�ʙ�Ţ��T(%u~s?�V=���%������Jc���/�˛�rUw#�>.���r¾��:��5oD�53����r%����H� (��r��,�s� �#�^�2/YM�r�w(�� e��L�'�mZ�*�LRMhX��I^�������@�s);�\r��S�����V>��� Te�;��l�-K�Oe�nU܅����ڈ���\��ӽ���I��mO�6 �u�:<0�I����?RG$���ܾ�6���7��?���ѳ�����s����{YaÄD�u�P�J��9���UK�C]-��M��eIӿ�i��:�ŗ,��3����ږ�%/����^�~N��G�����f'���A%��&�Y�MG>�����p��K�O�f������h<��C#B���=��Q{�o�&-���Ō�S�4K�xq��1��c6���<���
Behavioral task
behavioral1
Sample
0e2b5818b01d1c403521533543708b02.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0e2b5818b01d1c403521533543708b02.exe
Resource
win10v2004-20231222-en
General
-
Target
0e2b5818b01d1c403521533543708b02
-
Size
3.2MB
-
MD5
0e2b5818b01d1c403521533543708b02
-
SHA1
e98fea388b14e8b1136fc1177301f8573325b9a7
-
SHA256
489b57dac88a7b7e6f594d7b8041c7398b3877ed4077c7f0b5f5498179f3e33b
-
SHA512
fd8cacd8f35573cdfb55d77136eb7b6a8f7057ce863ab78db6f336b57e1a9cec063a15c995605b0a888c74a9ecc400c58ed43bee6bd25e691570705490997854
-
SSDEEP
98304:cEkmIDCKU9pTvlnMa6lxH149FBnC4NCv0aK:vkmvKU9pTZ449ov
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e2b5818b01d1c403521533543708b02
Files
-
0e2b5818b01d1c403521533543708b02.exe windows:6 windows x86 arch:x86
9ac4d4655dce3892c8c120baf0879a4a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetMessageA
advapi32
GetSecurityInfo
wininet
InternetOpenA
Exports
Exports
Sections
.text Size: - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ