/IF�y�K�%1��=�M ܟ����S(��U�`�r+�o)?h`��/fk����F0=4*���?���ŢkJ!�V��wr\�Jt>�lB.��A#T�X�C��zز�T��"`�T,�%4�r"?���hzx;�qdy�"�ߺ�έn��v��hFi�:��<�!��<�b-;��D�a������y}�K�B�q.�?�$| K��e�/H!�]���+�'z̓}�G��7s�zg��I�ct�����u�|��%s���s��5$�'k�O�^#��,�W�6M>pT���ۇ!"�������f�5�e�D�m���:�����z�ShY�D��rE���ȸ;���%�ԡ[졆֭HG�WXy�� edoM���ȼ� �Ts�����%��-I�K��̳]��;2hn��!Z�� �!�� ����~1T-E�b/H�G�U�{A�& '�������w�~D��<���8җ(.�ZD^��uZ��Z�}e(a��o��j�J���1x�0�kZf:a@@��x̼����(_��(��H�a������Œ�G�sy�Ba�'�~d��o�XS�W��j�tr<�>܍�i� �a������e��~�5߳�%���ϑSw��e;�"��֭�r�-��ͥ ��{��yC����ԃu� 1s�}u(�w����d2�C5��A/�hx�=+&�̤�9�O�X�3�s@�x�����QEg�q�|~p�rO��J 7�g�i�����Β���{A���N��� ���re ���q\�<��Di�{���c͜mM��y�x�[�rs����*�F�pǛ�9P�&���������_��̀��kt>�!�~�ȹe �1�qy���46�!�z�Q���҄H�캍���oa��ta���6��*����]A�r�eUUt������4��^і�<co���T"�a���ƍ�7��ԅ�$�*�r�{�#�RD7��������y�o�F�蹰�H9a�G^�NC7�8�$_�� ۼ�_�B}o;!��/[�0 "�����fk�4S5�0'.�$� �� 9\$�����Q�¿�o{�̣X|�����w�ڛ���p��r+o�M'>ƲX��h�uq�������Z���e�� �m�����Ku�{��Y�lt2�d��R�=�1ݲ6�~�.����o{)ˏ�����N&�ƅBE�Y?mb�/��r\s���z� ��*@O���3ү(�v�eR����c���n�4��"qd�$sF�|N9V�+���jj�6!�N_�m�}m��۞��>C��d}�y;�K��+a��Q<�K������>����t'V� � ��c�,;�V �H�A�B,zt�)���`��\�Y�C�;E�=�;�a��?;S�II��6{�Vc���]�V�3-y��]��ďf�WOr~pʿ"ަ`���mdRd'�j����쾱My��l����+����c�i��b�/����4��QhH��C.�c�|�E@J1��*���jO��5�� j<� SOl�f�,��4]��Y��o7�j�s�G���A��)[����8y����t�Iӻ*���m���ϤɽJ�z���>.'YF��< ������w��m�Ϧ�#�0��g���:��'Ƽ��M[U����c|���}������d��@�����%�u[? X�N�> X��o����#��o��<y$vR�� Ă�]�����-y���77h3,�?�� ��S>-A.N��ȺLiQ\]C��4�@C#9g�ĥ ��q�%b�� _��'gz�^��E{�@Pz;p���KAJ 4�p�:�x�Ɯ����{5�!S@A�V��vD���@�Y�w��{ �[�Y#��?ԣʆF�������_�DxЖ�٭EO��шew������w�����F�̍�͌�����+.!+@]�\�b���g7�|���C9X�����+����͚traw6`}Ȍ��#Pp Nn�(i=@�\�\��P����r=�u��������v� s�&�Wu�J ��ح k��2$vY�i�����p�t���J�E��Z�g_���:~��UPE���y��aǸ�_E��>��C/)���I} �й���O�۫|2�p���4�#`�n3���!���ږ���΄�ͤ%�щK;���f=NcA/�2+G;�/9�e�_���Fu<r�;�L"ET��F�~����Ԣ���P���z�y��h7���<�JI��IUD����}_��*�[m�bg�����@�cӭ��8A�e7R��>��d�q��kB.��a�#��� Qh���cB%�B�5���1����(Oڎ�y9�o�L���Ψ�������1y���ˋ�{��Ө��3 c�)n�qj�@2�ByAB��Zk� r�!J�U�[@n�`l��7ɉY?����nO1�'�Q�8���8�{ٖ�E����}<����\5��"i@Ʈm7̰&R+{v�|�e8i��D��p�h��8��딴��X��qxMʪ��I����;�����ۆ�������[y�q(`��3�q�����Z 7@�#}Ct�3~w����b���ߎ�0s�Ư{�-��+��/����P ���Y>�C��GjH�*Q6�9?EGK�]X~d�-��P��U�����*`a��)7 ڰ&���?x}�� ����,�;Q˲U#��rB�3�~�'/ �(G�73zR�ړ��s�f�*Vmj������������T`�#w���T�b欲����H���z��NA�i�M��O{ �S0��LIyP���ȴn�����t�������H��7�c��������W��}�����Ƚ��\�R�\��-K��8O'2�E����j����e�,$�zM�������T����;a�gL$�Nxd��Rϱ����t����ݑ�N:Z��� nk�5qb<���r[H�e����p�o��4[\��2�bk�с��GZG@�����iT�f"�^.��]&#��@Q1��^?���f�h������3YZ�Z��<�K{ �7%��2i���c���#�B�tOx�!ս�>���|U[�dP�����O��&_�mj����Dx��k&����Ā����܉��$��̭
Behavioral task
behavioral1
Sample
ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe
Resource
win10v2004-20231215-en
General
-
Target
ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a
-
Size
9.3MB
-
MD5
0b03a3114d284addb6ee45238a85b578
-
SHA1
fa1cecbfaf5484daf760a13a5efc4ec5ebdb1fc2
-
SHA256
ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a
-
SHA512
7501a7ca433a216a78d270c1a7d66d812e2c20dbd12abbb85b0189fdde74f131d1c4cfa0b6d3e04e4083b5105f003f7e578f5abca8dd4982d2114db739371016
-
SSDEEP
196608:UC45CtVx/sDUPoYPHMQWt9HSqaLOX+RJ21j7ukYEVpy:b45Wj/BPxHjWt90O821e+V
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a
Files
-
ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe windows:5 windows x86 arch:x86
367b82ee6d0e59759d59a9cf06439d7c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamClose
ws2_32
connect
rasapi32
RasGetConnectStatusA
kernel32
GetStartupInfoA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PeekMessageA
gdi32
PtVisible
winspool.drv
ClosePrinter
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
SafeArrayAccessData
comctl32
ImageList_DragEnter
wininet
HttpQueryInfoA
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 852KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 9.2MB - Virtual size: 9.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ