����Z��sE�s��j��и�я�5����Dc%S�u�]ſ�s`��άF×���2INXG����}�c�I�����.$�!7�~u�5�7�2�&��\�֝0x'��9�t���+�m���T����<�(v:GF40���\���$4�o�|*Qnےmu~�K���E���V)v���W��� z��'L����H0���Y�L �So�TBg���/�W��o��eP��L=�]*R,Pg��=���dsDu�H'��n�~F��hz� N�r� ��7G��� ~����(Xcqk��� ���O7��,�F*��W���攖q�����cb���s�|��K�@^L��uMq�4!mX��Ij��a�Zz��4`��&�B����\�����B �9g�v1W%2�'�TGS��lg�C�aʽ�K�bP�JQ���5p��<G�74�x~����zy)��G�I}�����/�Qqo�?��h��)扰BSo��.����\���*�d��v��&Ȥ�P�~C���IA�'����-6��8gs���YC�{H=��8��{���?)���Ӊ�)T]q,�9��&~|�"9Y�٦�Ƃ����|�V���+�[������hiy�n�6�R�s%%�4�[�����U�I����3J��D�K���1���o͉h>�����%eK�Y��͠-�ɘ�>Hpҟ�Ѧ���e�������#���v�5 �׳[��z��÷�q �;���(�˕���L/-�����y�I��-:�s��A�ﳲG���P�豧�NO�ż��)���k�8�]��mq>�(�P��M^�?Y��R��5"��t%m���9�C��W�U���~#sKu���������������c �l�ԤO ��Jh���6~kBK���F���� �`:����T��'N��y����J���O�N��0����� �3e�&"BW���\�0�<���K��owZ���������=�][l7����:�ѣ���2бc��]η�VG?��.X�B�Iͻ���_���k5\Sl�a�����V�VZf�6����ݐ��6�/�(��{��o�����[�,��a���e�x*�3����6/D���x�w�i���s9��5��I���AK�y��Xj����¿�ٌe�Cm����֜K�Moq9��G��)�6r(>��=�]��Em8�s����j�A���_�V5������D�7bkѺ�0�k�[h���W��o�h6%D���'>��,�WǾ�X�w ����*��`�>mz��� O"X���-a���c>������C��Þ� �Cc�M3G�僳���HS�G�կkC���� B�=�k�su��¿>+}/��VݑIL[��͝'�C]��!+D���4u$ÅT�OǣW�|̀#Ǵ�[�~���ތ�B�0�����;�W�����mT.�% -�e=���EV%`����c�wq�v���ʚz�#*A�n_85*?R5 ��Nd(ɤ?<��Ue�L������������Vh��U4�ז�+� ��v`�o����:i+��� \U� [y�;t���|��C�?���r�濤���-�K7�a��J*��A�U���)[(�]zy����c�k3��|~@��U��͔s�ԖL�$��k(����G5�.m2{�&[���C]L�^[���e)��< ��Q9,m�/Nb�D�pu��g�FEk�ӻg �##sc:��|������Vq6>r�Ft��@(������v �료0Kg�U�E���+�jJ&s;� 9���Ξd���w��̠��ܼT����.����OD=d��e0u���Vu:z�ԉp��������Q�`4\��w%�|ۮ�����҈Q�{c�]�MS$ �>���s��t��l."{�:������JF6�SM�t��� �i!, �b��b�C�� �d~C�*�JYA��Bq5b��/��8��)6�<:�UQ�<Ɇ������]��N��|wO/��}�i�{�b�.�F�O�I'23{���?S��&��*o&Qx��+����2� ����K�}�>�}2�#���<Hh�vâ��'T:�]FM&Ȥ��J��u_�W���5*�����H�Lb�3]��^&�fYD=�x�e#�C0{.�l�}9�,K���{��?/G���� ��d�k��Ӑ�#�T��|���C��$>�=и��ڄ�o��X�й����k�5 �`bZ�z����:;MA��S�\}��pJ'uMz��$/�j�=^�@��UY��d�Z�E����h�e����pF������P��zB�'ߔ9�2v�)'��A��N{�3�Y����ZW#Y����b��D*�J�2]�+]v���%+vVz���U�ȃ7.$$˚�|�h�2�����N��Z��uS3,�r7���d����!,i�H���S�{G{`�W�_�"��� ������3fE3��� dA��̦ц�N�"%D���~W�d��|GA� ����cUK��>��̸LPE��oG]�1�V��LX��ͧ ��@j�P������F�$�,�)Ly���]:T��j߫e�+��S�\�f��YZ_��̊c�&�����#r@�cڬ���[���.ŎK5l �{��\�?����_� ]\���5��ęH���9�����t�/kX�M���LU�=6������Xv�C��]�����S<^K��/��KqX��y�M|����P;��_s���3�:EL̓��L���܉�鎠6���I䇆ܚoV��=f)F�(�5�uۂ�T���;I����VB�Q��h\xj����lK���sM�m�C��?P�g�* �)�'=���3ޗ�\tnda���;S!UM� �l�!t"�o�)|���^����>�Am�s"K:���?�M���K�Һ%���%���=�E��h���Gc6{ħ�*�6Kd[����Q/��ɫJ;S�S=��GNG[��������%^f�����p����$=�C���$<�SeXK�PC\�R��X]������gn� ��[t����zߓ�r��6���OB�L�TjU�cM��
Behavioral task
behavioral1
Sample
3f2e3fa4be5b7bb535f32b11db2dcd05.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3f2e3fa4be5b7bb535f32b11db2dcd05.exe
Resource
win10v2004-20231215-en
General
-
Target
3f2e3fa4be5b7bb535f32b11db2dcd05
-
Size
1.7MB
-
MD5
3f2e3fa4be5b7bb535f32b11db2dcd05
-
SHA1
8a8a6c153a1cce8265d14cee8d6b921f499baa19
-
SHA256
28e1257a0041a6f573ec21fed6710c064628daea1619081b0aa1126ebc8df251
-
SHA512
755d2882719ec92989292dc94f406b3603b12a21447456d2e49998d4a0d04883f6014f99e4ea6a65e387a692d0aac7fb240eb1bd33782ea89f189b9162feaf27
-
SSDEEP
49152:8Uah7dT9KifPxxTEUGfKTsi2oOWZfYb7mZ8:83h7L15xT0KIhoFfYS8
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f2e3fa4be5b7bb535f32b11db2dcd05
Files
-
3f2e3fa4be5b7bb535f32b11db2dcd05.exe windows:5 windows x86 arch:x86
95756bd48ad57cdd62fe450bf3fdc040
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileAttributesW
GetTempPathW
DeleteFileW
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryW
CreateDirectoryW
LocalFileTimeToFileTime
WideCharToMultiByte
GetFileAttributesW
SetFileTime
WriteFile
CreateFileW
GetSystemDirectoryW
WaitForSingleObject
CreateProcessW
GetStartupInfoW
ExpandEnvironmentStringsW
CloseHandle
GetCurrentProcess
LockResource
LoadResource
SizeofResource
MultiByteToWideChar
FindResourceW
FlushFileBuffers
IsProcessorFeaturePresent
HeapReAlloc
GetStringTypeW
LCMapStringW
WriteConsoleW
SetStdHandle
RtlUnwind
GetLastError
HeapFree
HeapAlloc
GetCommandLineW
HeapSetInformation
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
HeapCreate
RaiseException
GetProcAddress
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
HeapSize
LoadLibraryW
LoadLibraryA
GetProcAddress
GetLastError
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
MessageBoxW
CharUpperBuffW
advapi32
RegSetValueExW
RegCreateKeyExW
CreateServiceW
ChangeServiceConfigW
StartServiceW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
shell32
SHGetSpecialFolderPathW
ole32
CoCreateInstance
CoInitialize
CoUninitialize
Exports
Exports
Sections
.text Size: - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 324B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 434B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ