������"m�J����W$��l�aҹ �yܖ������x2;��o����Ʌ"��n}mZ4��3&��[����-c �:�t������v`0�MmY�=�Թ.p�,m�h�K_��t��z�HSm�?2{�b�!�*�2[�^WW�b�YYTZH9��O<MW�����`d�1��=C��[��8��nK^Wk5�]�˻�e��CbU�o���EL���ZM*����1�a�\����1UrX�͞J�~#A�=RW��Q3{�Gѭg�?�i��,�:,��B?��Gh�A�6���O�3 vx(�@|Ul�� ~�c��Nb��m��o!/3��4���ԋ�ڕ�ド��c6n�w������� ��<6�� �?{�7�Ֆ���t��&���-q���P���Q��|���v��a�y&�'��c��ϥ��e��[T���� �� ��)��<̌�u���7�0q�Y����!ch�i��o&��?U���,��/v�yǤ��C0�m��@�7�m���p�1E�!>&��uj�n%��ʪ�@� s0��� b�9`�$��I���<!�v�W>tSL��g�}�S�6;��Gؘ ̄��11ԹH%�-�N��L_>�A��Z& �*�eeI��%�(%����*�gܑ_���9#��P���1Y[Y���2\�b�=֕�&�8a 1�] �^뤕�[��`"����*��<����h����/�A�~M(3�>Q�Q�M�D��8k�y1��YyM�m��1��Da B$y�'�+�p���,Y!M�0ż����;e�譭U�BJnu�^�mWUi���6:B8�4`q{T�S�j�� !^�d�O\�"����%�T-'�f*hr'%=1m�eW�g����lN!חP ��a�pq��������:�(#����a>M������$��s��pAQ�I2��7{��^M�rϣ����.q���lU��S3� j��du�E���uJ"�:Q_/��]���^�#�� ��DL�.�H=J���A���W����"k4�Ux[���M�!��65G?.���"���!@\K�A�YG��d:�ݸF3u��#����������p���GKR7�,���?�O�/��O�������É����:G�x!"w1q��[r,G���'��(E7�Mnc��a����uY����WM�G��f�ĉ2�������h����th7|>�s䮭����v� |3��B̜�S�-�/�̭-�ɲXQY�֚������t�y��&�yb -�֔�-�.�$��$����$g�������N�b�x����4��kd�>Ǜba�$N�j{h�y�DZ�f�p�wh{�;`���^���T�Ma���������/g�H�P�l4д *�h��jએ��Ǧ\u���tch �P�G������z)m��Ͷ��w62k�,��%p�-O��Ë����<#��%��F�z��2�`m}�tb��t�R�N�i����ņH��G�uG`�"m/�wA�� `���k��X��p' i��`k�56��У��&;��j �~��������Qh���N��ƒ��f� ^��J�oz��fPy�u�e�\��S5+E[)�m�R\t�Έ��}�$�q���'> J��27���-�oP6�BG�����H<�����!R٭8Fn����� Ps��ޥ���h�d�TM������� �W��u$v��KQ}�7�$��qp��f1�������{�oR��^`B�Ӹ:�!�*�C����xG���(����}���,fZ��Rn�l�;!�_!#`�@��s/ae���ŀ��Fdž6k%��gi���j*�b�:Q���O����g���f+��ڄ���Cv ª=���=#�85k��5��pM� �s�����8��Q�b"���+g���ZP+��A�e/��-S�����O;R8�!�2>�a+�I�f��&s]h��e�q9���n���X��_�-�%�Mp�� T�z�:�r��蜓��ϳq�{#I�cCó�?9���P������h���M�`��I�]1��8��4�-<|qmB�_��hu������r��Ӈ*Z[gl��"��Q��1u"%ި���h��-K:qƇ�F����tv0B��0�62�D,(�1����av ��d��v$t����=*J9�ӓ�%+hH|m�>��� �n2�A5ؿ a� ��OQC�p�����TYQ����X[���.�S߳�7��!��LG�0o�zO�Q�E~vy:����J�I%®����ڽ�ppܚ���l�T��!�#G#O����:�2b=o�#��]^v?Z2jT�N�X���7p�;����*d�ʓ+�h�6�x��H��W�݊��V�� \�#���D��ʴ $������G�->��<{nX"�c1j����$��*R �̸D��+֥)�3tF�d6o�ڸ1t��㏚�� �����]7�B(��S})FC�Z���C����r��]'W�Gg@ ���rt��i�z��b�ћ�(�Z�7�*�?_�)���S��}�RSWY*[<�&S���;�������Q6|�M��C��7�:��^H��8���p�G�Fݖl�H'M~�^h`����"ل��&� !�Fp#~���v�/!����[|�� ���>U�����E�d��'��E[#Ȗ���܆�h�;��t�B�A4���$�+I-��p8�{}Z�8W�:��%�8<�tN�_������-_*xdr����@����� w:�Hh0����n������� �4���B������N�XI�[�o%o� sʪ,=q��.�7�ܧ*j�~D\\U�D��8�v��J.�Z�,�5���h��Ȭ� x�!����Uv7��^-�X�[� B0(W��3q�,�[�|� ��ke�\�)�T%�� ���旲 �D|�2#k�g҄��,�i�p�1$\e���7[�`�\ڱ� �N9��'<���O�k����ISjH)�3��$��u9s��같L��g�$�r�&Ln/wkqyԄ �U���LTJ�9@�Y�� �G����^�h��K��F�Qrs�X�X5���P�
Behavioral task
behavioral1
Sample
2136731abbe410fb24240c34f1a47260.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2136731abbe410fb24240c34f1a47260.exe
Resource
win10v2004-20231222-en
General
-
Target
2136731abbe410fb24240c34f1a47260
-
Size
3.0MB
-
MD5
2136731abbe410fb24240c34f1a47260
-
SHA1
ffd5bb4b62d7816f0ce4af5843cd82ab7edf5cb0
-
SHA256
e63ae6b6a21682cc06993ce09d717f3713b04a84b5567653bd8ccfdba1f89f06
-
SHA512
1135ed12ea2d6df892386ec5726f5ec59418d5b9b42bf2db2bcf91d926912bda759a0b69db85eaf07511b88721118ac722728fd159aaf1009da9c4ab75d29f65
-
SSDEEP
49152:j2Tz8wIYwesVWRj1DLBaxMHQH2DeVpsjN8lLJ+cSK8ZOqUgzXVJVjIK9zWLNCab5:MzPsYR9LBaxLWD2sh8l4ASOqUQVJhd9E
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2136731abbe410fb24240c34f1a47260
Files
-
2136731abbe410fb24240c34f1a47260.exe windows:6 windows x86 arch:x86
3c27231b356af8ced28fb04cd41acd2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareStringW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxW
advapi32
SetSecurityInfo
wininet
InternetReadFile
Exports
Exports
Sections
.text Size: - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ