8��]r�A���7�H=��-L���§U~d��]_��I�D��5D3���T�F��4E����XJh��~[���M��� ���.�{5!~�q��W�����y�w"�m:B����ALD��&�3 |�Hd��5���0]w?�蟴&Jdx��:�sG�T l�@�������9N-��9B�t�l\��h�(l��h�w`x���7��OEU�P����0�X*��e*W=y���S�� ��K��UFH� ��<*���\��퉌j�����|Ra��[{eyg�)�<��E�B��0���e�C���g%��q9�H ��է���QM$�rR�F���|f\l�a91����u1I�x��;Y�}`�����5H������Q�H�W��hm(�Z��},���+M�v>�م����52,���%�����ߖI�H0I+`!p�����q^�t�)��$��/W%���b�0���C�x����������g������K5&��W�~5 �Tdv������.V__=���nˎ��D?2��3�t(y{9�A�AB���!*�wDG�������� �1�g �R"�"n���E3�Є$���9��y�uR�*��s{��f?v6��"A������U@�GY'��VF����>|J֥h�����A�=)K�dVר)G�b�(��Y| %�|IFM�ê���G0�ťյӝ�"�B��u �k靪k�O4���+g��`ﳤ��bMzPk�Bw�#�~O������VB6��s�jO�_~�Z�~KU����|;�N��ԮE�����X^�����b�Uc#�p��R6q��?{�M�����P�h�L�� �\V`x�3�����Yw0����6�zJ�<�����Ϫ�Z��#9Ry4uV����1���X���;5.��~/�Gu����ċ�j��SH����"]���s2)�F]������,��e���!�%��@�5���|:��g�iޮ����c%A�����9 ��5��YM����a"�ұ@�<�ɍ�5�>X �]J�~!��F�����#�|�5>�"[s�#7es�.gӶ^�I�* brM��Rc.yl�1cx�p{���ob�ʢk(��]]���m ��䇒�Ӂ�B��p�>B������?ک͘_F���gҰ��W��Y�f�hlf�.�K� ~3ҢD�H���vZ�eK;����3��b�S���`�-X�j��,o ��H==-�ݍ3�U��~>��U�����%2�~$mn����{�M�G0G�f�nL�-n�Sr�VU�5�)��ƹ��]Ը�7x�ZI�~l�\9tU;?��g�/ߘ]��=���]a�h���?D�B),H��r�� yn������"ٓ���ƭ��|_�T+�`��� � �ݵ���v�`�tG*�o���`8Z����EP��9k�sV\RgY�N��=�!`EK���+��0�ܫ���+�A�x��XjjɌ���'�������K�r#^_�9�FP�[�G�YͰ%�������Ѕł�7� ⠥�����{w�t2d%,B�EVlb�OPa�}+Wt������� ~�<F���=�� ��\xV�`%zQ[��"i� 5#�)�zfr��U���v�iN��7|������O�skjl�f@�� e��>��ud�\PY6�}�C�s;�?١�̷�RX�� F�S��44ZW:������<Ks�oQs��-�-�ǘ��M,3L9L��^>x�AkQ5������lGF��,�s�e���, <��������Z��y�8���&'���̜D�����_�3��w{�R���]�1�����15���ƾ��+4<��[ 2;������|!� "5��wQi����t�V�S�`;���!�q4뒚Xs(*3�)վ��P��Y�ZmϽ�WE�|s�Σ��G��Z�kn\��.�ۢ(�Q����')��*a��M��E�V������>��S��7�S���Y�?�QeR����t�i�e!��P�;Qd�����:~�:�{��g`�� #[������>_X����4gKq8S4�q0�?��+aÌPX��4����{]�Sn�u��H�f��������H��Tih/��D @,\!�!.*�cJh��������a������=���T`#��%���~���WiĪ*�����t������wM�տI5�=Y�����~{�������X�]�� <j-o�l��U� �NZ��'�q��q�{��x���l&�Y�VJ��ǹQ{Dȣ�X�d���[�l�43N6���$��cX�s�r�.��������Ԋ|j�u:��.^$@����-��I�������v���������xB�[�a=��GU�v��Y����Pñ<��� X�L�kv �vU��Ѭ���>e�� �m|t�_N�.���c�?|n�H�r� �ɏs1�����&A< ����ij�ٵ�^N��g���W��ϙd����^��R�nmT���B�����El���V���q�4��9����v���nw�����L�(t��Þ��~$�7mn��,�ۯM5`lpAn���y��|�-���0�E����y���j�m.�>byC�Θ��H�y��bڨ�K��b�>�A�����~���w�zy��ߔ��5��-r�{JFUn��A�@�����{e!�}h�Rf�������xY���=K?>�q&�dZ7����v��,��o��Z������8����}$^EtT�jt���+� Xw��]��9�R9��i�PN+M�r�v�?�)���~ٶc�� %$[G��)>�?Ӏ3�mi��}���YuV���b�E�rQ���<U����B���"z�{l$8{-(��tsB���u��B;*�L�-m�]���ÅT�\T Վ0�Gh_'�Ŏ�%��5ԑ!l�? ���ϚX������c�ĥ��_TE��!������{i��{��V�p����^��Ļ5�����A�ڑ�>��I�"k��Zň�:�Ǒ� ��]?\�a�����LN�P�[o(�ᓁ�e�8���9qI�����n}�=�+��?�%u�;"���Ě�rF�ip`�/��T�l�H_Թ��d����]SՈmv�C@Qw`�8�;
Behavioral task
behavioral1
Sample
415c66c36fc9a45fc9b03e8e4a8dd7d7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
415c66c36fc9a45fc9b03e8e4a8dd7d7.exe
Resource
win10v2004-20231215-en
General
-
Target
415c66c36fc9a45fc9b03e8e4a8dd7d7
-
Size
156KB
-
MD5
415c66c36fc9a45fc9b03e8e4a8dd7d7
-
SHA1
4c8d6700904b2bc6b0cc33335a4b7e9fd676a66b
-
SHA256
d696d0b9f6c6b35f2636e73bdfcba357f8269a72a9add3f3e3d04a9d62cc5e53
-
SHA512
a84019214ef48ec09590c6814ab97c4beabb0417c4c11f190663ac7f496a7e915828548536bc5c122269358745cbf920b87f41b03f12bb110653e958243d4925
-
SSDEEP
3072:67I16PZVVJfAO2xIuddh+vIulul00Ej60FPIEXs3NGRyqnYgK3hh:D16PZVVcN1Z4ul03j6aIE8dGRyqnYgG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 415c66c36fc9a45fc9b03e8e4a8dd7d7
Files
-
415c66c36fc9a45fc9b03e8e4a8dd7d7.exe windows:5 windows x86 arch:x86
088ab1f35c81a9727702aa3dd0fd0c93
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocaleInfoA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowThreadProcessId
MessageBoxA
advapi32
OpenProcessToken
shell32
ShellExecuteA
ntdll
NtSuspendProcess
Exports
Exports
Sections
.text Size: - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp2 Size: - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3 Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ