��ײ~B�&�>���3�^pR6��[�� ����:��%;�$YY*U���7� 7Ǿf��ζ�x�ZS�Ʋz�G*B��3.���-�,���XZzJo��X3�^�E9��gR��ReXM���Ҕ��w��!$�>{1NJ���[�͠�sP�i+X�#hN�ZV�d���r��{2��L��ӧgH�� �,��BM����� �A�"���@���_�Q�Ԣ�o)���&�f"M~$^���o�1e�1`����)`��j�j�#�I뼉C������d� �QPz|tf;z�N�+�� єf�;8]}���\`;�4ם���8������8�ک�#<>��ƕ���1�� eE3<2��"�{��D���.�~(� "Ȳ�4�tT�R�}���� �K�K���2� n:��m�@����]�M��$i��g�*�&@��6 ��5���"�����$��D6�%k�t,͂���eha�?�b���h�o=��}B�k�{S_a�M����k:MV�n������Pk�.�@#�<�i3r�oj��mA<��w�+���Ղ�uM���ߩLE��p��Y��ð�:�ۀ���w���ex �1���=���������>��KZ�����Z˹�Dw�G�������2�O���3r�A�U� �������?5�99���vU�AL���ڑ�<=x�:�Nx��g}�g�Glr��3��Q&cԳ�557�C�� �f'M�#fQ��p!0ۦQ�`�^`��0FI+#�`Je������v1jo�z�\�65��>Ȩ)�m�=�o����XS.L�:��|��d8�������n]�t ���̐3����L�ppl�.B��N_cul�������a,F�����Cf/��-YOp���8���e�V�$�@{*`�5��|�Ra��.���`3�٤I���D+����q���C��6�#��O&(4�����<��I�P��o0�!*��d`��-��v�7����/YVO<y`*�BX$�kp��,(�:���A��������a�MrK@V�,҄� �{Bs�$>��l��46�fbv�:�Lq�g���(�.��N����Fc��s�2v�\�/9��v;�c a�@���^�����A����J Y��3AVL�l��h��α��]-ʿ<s���kֹ����g9�}�ts���DvU�'������:��ė��8H��־ϋ�MZ �{�f��E*~��>Ϟ�8ͺ��yf��愷e �ط^���O+�`���:3e����=M�O{�%�rV�%Α@���Ɖ�s�� ㋑d�r2+zֱD��h��'40�85QP �x����v�Δz��3���p�m}q���7�YV�Ԙ��1��;�Թx���DN�J��gEBV��6͉[�״ 4��ȃu�R<�#}�0|�Vt,4y����BO,�+��;��bڠR�%&�LQ��T�����˴?�r���pU��'�XK)<����"M�l�����z`��h �;�|����� x�a�3�In���FHA4=>*�9^���z�7���㎱9����=CA�z6�5˝���67����D�l���8����@�dI0�MW�ds�ާK�}a�1��r�W��������".����O��<��tSC��@��̢��_h�]\05x������x�� � Oz�s���p��X,pWcQ��L��Av�-RXD� c'���GϞK�1tC��y�ciA5R�씬wYw(*5j��V�g���3)�0�6C�/ğ?ր��Ք%����$���?S������*0dF��,���c�0��R� 8mI^��i�6>\�x�5J?����{"���^�R'd��?\����|�H+O�E.��iy��m����"�վP���ȗ���Xs��$��Q=a<��!���/�|2i5��[�B%�����*&�V�fXHbPs[��H�k}4~��C�Y�H"쿆J�� �q�ѭ����`�(y��hdY����U3#@���wy����%=a���<�uj��T�-ks�P�3ˈ���ί}��`�#,Q�G�vs��}���B�tX$�]k�g��gTQ��m �)�+AT� (���u, ږ_���.�������x�9�m�ݹ��9�� re�F������������7>��?K(���`Q������z�Am��h�y�{dVXC%*�(ħE��r��{�ہ���/�E��K>�ѓ��ŧ�]��_b����!(��O����@p�29h�]�1��y�ٸ��_�1>�y��Z �]�4�[������(��F���߰�%��ok��r��������㏕�6�O1֕����䚊��e2>���%�'txu��>�V{��ٹ @�Y}/��C!�C�D�g(��HZ��:�i��cwt���I�����p�#^K��ѻWQ�T�ݶz�39�-�Z�G,���t�l����S����G��5p9���!_�֬z��������t�QAu��~;�sB�D)!���G1��Y�tc�#ja{���a/�G��3L��<�`� +Zh�闧{00"-��'�f��ů)lԘZ�7)�B�/����, �u(+�7�f9,�:�Nt���_P�'�x)ׇ�s��3��wn��DI�S�����mF�"���Ƹ����"$�|a�[�j���j(��C�MP��J��9�&�@�^r�,�z�D���c��u�G��/��9�G�08 ]�,��4s~��1�x�R����� ~��@������6��d�����D�Ἁ1�<0�ʁC7�b6x�O��${u��Hg��eU���jT~Vfrsƕq���u��Vt���4�l_~�F��~RNKs�p �ީb�OR�5Q���'��g(@M\[�L��$v:�A8�Y�K�1�1)�R�_6�4�q��������dᲱ�������:�6N>����-�(�1��.�T�Y���x�Ɏ�i�?]N��(��������=�ղ���9��I�`�$�^mS�8���[���n�I��O���]���I'�#�/��M�\�A�|��h �aR���kd�
Behavioral task
behavioral1
Sample
a54d7ec8c3cf8c7c59874172ccc6c308.exe
Resource
win7-20231215-en
General
-
Target
a54d7ec8c3cf8c7c59874172ccc6c308.exe
-
Size
7.0MB
-
MD5
a54d7ec8c3cf8c7c59874172ccc6c308
-
SHA1
710e44faa923959bff43da626e244e23399af850
-
SHA256
8ee593ad8886ee4f6c71386bb55e2b21d7ea854e8a7043985aeb64cb798943c7
-
SHA512
513e9b1c54f6c2bea6d22e6f0d1f0eccdcd386a2249d28b76c0a4c7e29bf3369be36a6a61d0f2083f5f7a67664a60f5d601ce0624d8c063ffd4c9d5d6e95d22a
-
SSDEEP
196608:4qfydQRBowS+VSQKIQYQ4z50u5jkCklYsurYyHvA9o:4uoQ0wSGLTz50uONIrYyoo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a54d7ec8c3cf8c7c59874172ccc6c308.exe
Files
-
a54d7ec8c3cf8c7c59874172ccc6c308.exe.exe windows:5 windows x86 arch:x86
cbd3190948a889f144f067b4f01a708d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersionExA
GetVersion
GetVersion
GetVersionExA
Process32First
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
ole32
OleUninitialize
user32
MessageBoxW
atl
ord42
shell32
SHGetSpecialFolderPathA
gdi32
CreateCompatibleDC
advapi32
StartServiceA
winspool.drv
DocumentPropertiesA
comctl32
ImageList_Duplicate
oledlg
ord8
oleaut32
VariantInit
shlwapi
PathFileExistsA
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
iphlpapi
GetAdaptersInfo
winmm
waveOutPause
ws2_32
select
rasapi32
RasHangUpA
msimg32
GradientFill
comdlg32
GetOpenFileNameA
wininet
InternetSetOptionA
Exports
Exports
Sections
.text Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 745KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ