�h����5�ٞ�.��"e�eH��q�G\�c�\���)e�ݑ��C�8a-���ԫ���`�5����ǥkj��tW�o�����]�2;f�� �T�����o\B���1�ȍ���$/���e��8��T0�ZPe\��ʣf�rKeHu�k�W>? �����.V��հ�����|��1�vŸ+ߝ%�JU����/�����J�G+Ev?fZB&{�����#���ό��s0��t��7��f[T0/��{x:����c�X/ �����GR �'i�U?f�m�AL��xf�2���k�>�����T�r���o��a��>_��G֪� y J���X�Ȝ�9� *��WĊ�.�D��*)v�����3�o2[s;�����THh�R3�������|���J��G�>*��S����9w6�����e�=i-Y-5�Kq�q�F�UQʀe���T;��t��c*�;�<������z0��seК����=�1�������{����4׳lb���0����&�X$L���*vy$n�ܟ����4�Oi���-Ɵ��j�@�� >���;�P���s>���[%� �e� 7P]�'�KHٺ ������6$ ��$EnZ���ܜ��)k�p��J/�i���� n�M���s���,�����v۞�9L�oT~�P�;�Y����&lԄD��X+Q���,xN������&�1,m�FA�)l���wC!�,��������y�����|�"�k�ݜ��\��>4�J�2Pf�A1X%���^l����p��tbv�Vu�}�E�C��d��"V�3(���S�_�k�˘�Q%���Zr1��]����>-�4����K,���"qr�Ʀ�������U(x���պ�G�<N��n�ʃ�r_�5�%SZ�e�M2�,M��:;�It�-���� �'b�����;f�״�����يf����c���11�c�mK�6��nJƜ�[���XJ���ەUG���L-?�H�N�հ�;�5Uɝ<���6�!��'�GAp;!(X�U;�X��{����Rs#�q���Q��p��i�� Q�8�IB 28J`���~����Kq��WO��S�ǁI�n4�A��� .-6H�@[A�q��R qn,u�����L�>����-�<�ǎ�L� ZAiC*�fU�6��hpv5�4���D�Θ������7��WA����S`���xl���{�PG;[MS7��ɣ��C�[-�eLV01�� ���"V�a+L@�u �!�_w)m �5�!��W�2uo�o����j��?'H�4��Y�R{�b�l���)������w�RG3������h��-��(6. �<h�_ӫ�y.ylI�H,Y;;D�<Uy/�m���ĕIKRFV��'h���(����꘎1 *[m����z�o���p�!(Gí���#D�������,�$& Vy>`�����Af�4lʸl��ߵ�w�\�@�v^���f���P���#VO�����4{3�X {kߋ���yn��{x��bƥ��j�ZcŨ�O2l#�����>�35����^m�8,e�H6�g�*�v����s�p���#��Fn��e����� �g�BS��9n���P_uc��6�>䟮��c ��,�%ӌ)�^�z=z��D0|��oQʟr�����M��?C��9������퐓���C��t&�)���$V��8~�`7���y�G�^���<:�!Ӳl��D61�N���e�{?�Z�u��ǡ6 JiĤ�����"O'� ���BJ���=����I=��f0�����,��D~�>�=5�ʖ)��(g��e8�iQ��bG�K�D�~�u�T�g�Yw��Vwq�Hm��;��'8y��<۩�Md�2�k dR`u7Lx�W1`����;�L�[:�����WJ7\��D�(˒/;-��g�܄�;"%���e�8ZF��+zm���0���[����ʍ gx��֤�j������H��H�^�"�M���@�/����7�u����f�����G�{·����ȳx}e�9�L�O��{@��dw��5�~�:ԏ79Qz4En���ޠ������LD��;d�$筐�S��c����pC:���C�Ǥ|B��:���-2i��gu2=��(i�oR�U8�Sk�YU�[wmg�U2q�.^0L��c��=�(w��58��F���xX�Jl���&87luM��[��(���Ub7ɱ[?c�m�+��eC�#Э����4&��g�=��c�y�v���~�)�.-�$��+)�}�����= ��|��lk:��Å�>A��:n�)=Qe[,��W��l�b �j�Z5O~Um4�^�1��Ψ�����p_R�]]�la"hk�h��W��j���� k +��T�_�V(}��-z��G�b��� gG�&'� �+�Ԗ��� `�13����8m�*�*�mc�.""�-��`�-��紮I��|�48�+e�0RO�����`�e�̜^�.�9� _[$M*�+�%"��lҾ��|E�Yӓ:�A�DF묬�r٣���.���Ƅn�>��}��dc�_�c��<7|��я2 1~�&���:�%���?�Y��YQ�B�9���k����[��+ ;�܊%��F�Y9�F[L�@�V]�dvY���O�g G�Qn(N�@�F6ꓣ6S�I�8��ƒC�+p�Yq��}3�|���Z=I��U����ؓZy\�j�rY������;{cn��W�*,r�iW���Q8�Y)�hy]c_1�==k���r�P��(��,F����#�ͧ�ھK��Y�0�~ˈ���E4T?������#��$�R�M���o�Yh|�r���'����[s5�Ǭ�P������B`F��P�}�zb�������|�"&M��2����Xf��A�#��>��-�i�4Y/B����:��]�����);V��ӽrue��>6���� ;'���%� �r�3���k��^�w���1Py��(�u������P�w_��7%�ܳ�3S»�f� ��r�,�bM���9nײ��i)�5㤞#`w�h��]⸄��5���
Behavioral task
behavioral1
Sample
4cc40a4fed7198bc7bf1a2107d4fb331.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4cc40a4fed7198bc7bf1a2107d4fb331.exe
Resource
win10v2004-20231222-en
General
-
Target
4cc40a4fed7198bc7bf1a2107d4fb331
-
Size
512KB
-
MD5
4cc40a4fed7198bc7bf1a2107d4fb331
-
SHA1
271cf3e4ce9b97fa2396b4b3ee81c6c7128afd40
-
SHA256
09fd45fed24ea60c830749d53bde0e0cb0df39b4df5e04834b16357dd46cb751
-
SHA512
ab0b576948b0591c5f49cff722a66108bee66191489768563cd024e564f440dccb80c0fb1695c5e7fad4780677b336a3535912f9fad4abd816dddf1b209310e3
-
SSDEEP
12288:4ix4uDbJGC8tLzM9PIAJwrusrDE0KzjHuVWYA8:pS2bJGCMKqrtvY3Yb
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4cc40a4fed7198bc7bf1a2107d4fb331
Files
-
4cc40a4fed7198bc7bf1a2107d4fb331.exe windows:4 windows x86 arch:x86
4108466851d273ee594a25949164b3a0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEndOfFile
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
OpenClipboard
MessageBoxA
gdi32
SetStretchBltMode
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
recv
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 492KB - Virtual size: 491KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ