,�*�JfC��u>uc�z��3�}�LO��{8+�I{.��l|=�����W�ut�R�Z����e�O�@2ASnjhʚgq��Jv��>�P���F�P�Y�6���,E�����[xR�t�z��8� �m����Y��ˮ�z~E�eC�. ��i��"F_xbDd�Eߍ�T_N烨�k�S��l�:h��N_ +�0��f�>E�T�xM>M��y�ba�?� �\WQ������ >�e�§����D�I>υ�d'�r�Ō�����у���*"$�e��V�t�R4Z��W�|��IH� .C�)� �/���q�9��&�6���5�+E��)����X����ݮ9���bR�2T]�Z8��N�F� �+� ���/Nc��h;=��� �0NfVm�WCl��-Z]���jʦ�N�rf�����TЈ�0�xq|�P�����=�Ɇv� ��}��� n����L*��3�YB���������S�9+ͩY۳�6�]F��� ��<����ߪ]h�ڀ¯����(7:�KV� �\�F��d��2�7�/F�C�tP�>���$�!GM��]������9��St%��`�������A�oQ���[ p��a!V�Ȧ|��L0U�8�y� s^l[�г�I#��+���l��7n*�vX���SJ`���8"g����dY�!<R �S��鴄��<\l���/t�R\1�&JXK7 Y�p�C��Ht�� �M;h���������� �ʇ/��X��<��]�I�[����L|� j��U�p�� ��Y�mQ�b7���Vj~�vE{w^�ȵ畛��+�Ǧ���9�)g@օ y�Xf,��L���Q^�� 9S�y�mʦye4 �E�l���9����<�CU��Æ�"p��G��� >7��0��Cxj���*������w�d�LK�[�;�l4mq�O�M���/Ci�I����P>��M�����!t"&��<?m�=�<���8���MU!����s�)��ֺ��B\�o��qD�*��ѐ&�����,�$�ɳX؏@#�E��5��P��=���n�NΗ����w�8 �j&46��'�����G��(|�Z�>��1�#s<-G��2��5�)��|Jh�����~EN��Y��|o������lj����>8���Q�"�Ħax���4NP�yw*�:� m�D�"��ǟ�~ga\��wi�E(�'p���s�[u��>}����J:k=�v+8`�7��3�H�o���F>���\P�ӂѼ���Pl|Ȝ� ��50mkN?^�c�͞�����o����I� [��gqo�Pb��7~�� �*�%�32'kq�2a����/�I�Ҷf3!5�{���Ѿ�q�vXW���q<b´��h]Lb6�����!2�4�<�7C�������e���V="����� �s�v��^A�ʂ�{���c��l��C�`��Z��Ί(I���E�K/Ƙ5�R�zug���.�l-8�Gɍv�@��FI���æqz-a�AG�J�Jr��StP���:�^�wN�C�%b�g�i-�z�\��� Ya�ٹݗ��C���N�6����&���1%0~ςNp(�隝�?��~/�ȷ����_��u�'n����/�1q�z�e�G!C���_k�r^�Bn�5��� ���/�L��HhrS�ޟF@��o���9��(���1z��aG�M������ p��r4%���5��V @|Tۭf�aP ȸ�.��o;��S�y�.�n���|&F~���e~Y'���)�x��tn��r�\mI;F�iƬ�O�.�KM�Ƅ��q���{��b��ٌ�<�M���O[�P����L ���=�&/�#�x�3M�W����I������?��NA���R�֡�l�~Ԫ�5,�6���%sjB�a��� 29�C�`�@����~Z���9����ʤ��h���4� �'��I|t^>�;@R���6����� @��uM��^��\Z�`�'�\����Az��������\D��Fg1��)�(>��.� ��hc������ѻ*���N[�)&TaF�}L�T �� �)5���OA�GN&�BEƁ�&�@�h*+ׅ��?���7~�*g��Mh\ӹo�0(�V7ʰ,A���k=�/�x�s�f@�X5#k�[H ����;oc�؊.��Rd��m'0�g�I6���֘DtJo#�4˝��C��+L�E/��m��f���ɳ�6Կ�s8M�<�=0�f�1��nE`�:���H)��.�m��6F�D�\^8�Y��O�Č�{������BV��I��=��*˗��{���I2DKu 2&^��%xG���%� �Θ�I���IR�2W;Db.yç���K����S�l�p��g� �o�#+#��<3MR������y���lF^f�Ӟ�|�X����u�����dY��œ\Vܧ� Y��-n�]:�a�����C��J.ӡ�[�� ~����i�D���6$�r+VhZg�y���Qm�VqiMѨB��냪6N�PN�f�@�F�ٚɒ� 1 �S���e[�8@��PJU2�[<��T���ʎ5��Ջ�8S��ņG`��i��n�� �x'��b�áGm�4���"6g��<u��8�Bv�S�;��g�n�\َ�q������n�������xc9z�^f�L�����d���4�����l��,օ�J;o���H���H�Ex�}V���t��_�(h�S6����ˇ!�f4�0d@FZ)�u�j9�-[u�iuUKzqu��pQ��A�5:���Eʚ������l�灤1NzkX�U�A��`�@����s9/��T v'�"�DǴ�jr���s�W�3�pIJ��$?�w?h�Z]�/!�:-jb�����aۙ\8� ����SU��}�v{�Y,m�=ƤI��6��JmHPg�@�9����_9^X��ͣnj�*���5i٢����o�>���ɣU��/�S��d �9e��³�|��})�6$O���I+������� �3�j�6J�z �Sv|nM � �����`/�T�2I)�<p݇�{E.R=E��˖0^����?؆\��jcن����z1�|o3���ǹp�Y&�
Behavioral task
behavioral1
Sample
4bb715d31ae6263d2e0d9fb1e02c9c2c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4bb715d31ae6263d2e0d9fb1e02c9c2c.exe
Resource
win10v2004-20231222-en
General
-
Target
4bb715d31ae6263d2e0d9fb1e02c9c2c
-
Size
124KB
-
MD5
4bb715d31ae6263d2e0d9fb1e02c9c2c
-
SHA1
4683c64ae26a22b27aac738f4e885455d0373758
-
SHA256
e3659da813f9622f97097552d6b3dd07d3f41ac617fae11891a778d1c2e353d2
-
SHA512
09975e8db5efe7a72162c3184b83105983801ab09fe33edda563d9e992dd0ba47bee844ba2ad008c01f53c2d963afcdbc03e762a9a56c11af1b06e6c87e9b332
-
SSDEEP
3072:/qqb/uqHdxO6gQqPfBWRyVttYr+rcSfrLG:/HbmqHd8ZQKfB6yxiujzLG
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4bb715d31ae6263d2e0d9fb1e02c9c2c
Files
-
4bb715d31ae6263d2e0d9fb1e02c9c2c.exe windows:4 windows x86 arch:x86
c84da386a07dd11a2cab562a5844f88e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateSemaphoreA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
SendMessageA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
??1type_info@@UAE@XZ
comctl32
InitCommonControlsEx
msvcp60
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 104KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ