5�M���/���Z��:��BCr#ʫ�va��廝7��L�,�/τ?�ޕw{,�lp����2�ZP��>��!6m��!��qxH�]���^��H������+�3>be�B���ɑ-�fs��"mc���hyk���%|{<��u9�9c>cF�@v<��u�и�F��d:����A����V�I�`�-J�D�� � ����$|L�}�>��:��N�0��_h���<��8�x���B�&�=�B_�����N��u� ��I����-殖Xf��d��`ꄧ�J�������j��7����dػ����*E�-���0����"��*�OS���0o��,$���4�%g��)���(o�ˍ���pLy��sLy��/�x�4>�U��vj���~vp��&��7T�"b��0��%�����ъ� }���W1Te�r53��V��D.�z�!��ַ˘�C>k>mM��-=���}3��ٌ�� ����C���]��Q����J2�A���|�V3B�S�ڨ��k�����W92 ��� I#_���u;�91���5{p���֖³MË�I.2�������� A�x�u��4Ea6�|�G�|�YCFB�UO*�J�E�ᨥTe5:�����[���⯿wQ9��Y>�$aB9���E�����ճ#0$�Bb�j5�YP�xZ�0��4���mT &B��$�S�ش�,�B�|�@���Ħ�ۿ�*:����̮�'y+��o}�gJ��C#�_���u!������X8���{*|��k]O� ���G��\���ܔǬR�+hɵ]��]M1�v�Vk��J"cze��O�xD���Si���+�z�3�{9u�ڲZC�3��7o�A�q�I˫��7�w��m�/) ��ϕ�+e�}|wG�C>�����[bA� ��n6����{0��jEPtD�)��VY�x����N7v�6L/�Y�v�k3E� ����d7X}%���h +���p��,�#h�A4i!�z�k̀}l<z��6���V�� [4����(�wi8|i�E�r�*�^qt��?B����@؛�����p��#3 �M�%3��w g��mRK��b�V�� �}��j��~Ҡ�Г���Z�0���![$Z���8��O�:��8�'��[��?.�JLL�m�s/�Ժ|Y��nS� K��q'���!�<|�N�W��hl�J�N4��'b���8I7�V���ç��m��ц}�P��ƣk7����^��$������찗�1Ƭu6�롛�ړ}.?(����n�����/_[_; ����'�?��w��p\�3�}�pMQ��qg��`]�x'�+��T���k`�=g�ؽ��o=������2}����#�+��"`�PG��U��?/{�E�}�?��Е��l;N���\���M��u�*�ԏDJ�C���[��2?��X��j\�c�u%��!���V���\�Ae���|=� ��o������b�{FO7Q���ͻl�M����'cN���4Ô��A������b5Ӫd�0>Of �|�z��:��h2�s��7j�ܯ�W��Sy���#��X��g���<�?Y����!h��CyRrL��0?��eʘxw�����;�&�ɀsIB�d�/� ���Wc�ݠ�7-h���Ud�̙���fe��\?!�;���%c�B7��مF�o@Y �S"S�����N,�<�O���]*5�=�������~����^�*[%!�~�1v���ڃh��vEp��űIH6��V8&�W\7]I�1��9J�d�z��;�W���Rlt1�Ⱦ��N��q��ue��3��"#\��L3Ö��Mr���m�udP���?kM��L�ѡl�M���u9r���p��&��\�^&����U���y�JY�E-�������2�1�X]�=%���?ό���(�vo~��n�}�p��۟i��b���}Q� T�kM�ݑ��ژ�q;�^���+��=� �� ��ݓ���8�P�p������ͧ�ŠO�c,W?���H�ה�@(i��P4�"�����Uc?Q�_\v�X�yn�뙎 ��"nf�aڵ��"&� m�x�LI$�_�6�L�DY$ 1�\��F��>T�,>E�3ă�Bz�����D��]YRG�z_B����*$��H����]��<�Bf��g u�1*(�QI����܍��1FA��&k�Z{��lj�Tz������O�Y��ㆰ�j�����<*B'=Z�<�K�۴��<���C�vd����hS h����FN8"�ioL\k�� �C�|����g���!δ\g��f�����mj{+#JeG����։���iF0���aR����W���[��8s�c =�,M����7����R*/��9���P���1�[��\tX��W?�N��=rR�̠�� iGR䵤�~oӠR�@&X1Ճ�R;;�r�꼲y�2������L��[Н���)���n��l���{a��)�:�~s�7(O�<=9�z?�=��Δ��N���U�s��!��W/1 ��1E#R>��Pp�U�m -d���=$$.~��ˎ��1��x g�Z����9v���ў����8;j����lȽ�~��h��3~Y�>��G|���j�Xq������cf��a���0�s�������&����v�TQW��l%����ќ�pz�L��ṭ��_K� |a~��G�k�&��L#�u�ܘ����yb�B;�>���S�~/㜈�/ҁ[n��#���Tn������r�e6ţ������r�C���G1m��CJ��ýn����N�0J�˨=�?|�N��mr�Wk4\R�r�����d�!\��!�V��*�8�Н|,%0PN��o=@��7El�ZB��`�$}(���ڰ�A���#�����PB]Sq��<���r����*鞱��O7�Ja��|R��o� ���f��P�g���w>�^��VQ�w� k>q)�->����Z�5:����}]�Z�P�NE�NtY*V�}Osa|��6=��(O"�>|�o�����>y�j����$$�7��d��-��Y��֊3�4!U�U�5C\��}o��"�*W�nZU����ȹ���#ߩ�-ؘ@e0
Behavioral task
behavioral1
Sample
137d505b3e1f5b9d563533ebd08abe9e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
137d505b3e1f5b9d563533ebd08abe9e.exe
Resource
win10v2004-20231215-en
General
-
Target
137d505b3e1f5b9d563533ebd08abe9e
-
Size
728KB
-
MD5
137d505b3e1f5b9d563533ebd08abe9e
-
SHA1
6c9935c160e4dddfe512ca74ed805d7a84d00720
-
SHA256
542379541402d80839dee2f0c985f718f05d5853d3bfa8fa817fe582302fb47d
-
SHA512
df85863ebc6c8d3cdcea4cf162c439a90db2de9f39dc84b9b47f875fa02b8068d6cb90831484dc812e81478ab815f6898fefbffceb45b9218d0d2fee3b653100
-
SSDEEP
12288:DFHtM9Cuyv9SMLb9shorUeCpd0AoshXKYT9JtscMGxJ8lbKka17rzxpvtfOT0OJy:DMyv9SMLJsbTEWT9lMWmK/17MTHs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 137d505b3e1f5b9d563533ebd08abe9e
Files
-
137d505b3e1f5b9d563533ebd08abe9e.exe windows:4 windows x86 arch:x86
79ea7d6dc79931c5fc0e62543db746b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_Release
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 680KB - Virtual size: 679KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE