������b��0lu��AE2�pv�����:.���0���(�1�S�����SV����1��qr�A�u<�/�gV~�0�IK�&�����*.��?k��V�7.�^K��@Ť��i܀tmA����2��6�*�8!p�-���d������N�ƹlic���?:��SI��g&���Q[�Y;3�\7pw"� �*�� ���2�'��O��ޠ��ps�?��@x!�;��_�1�x�y��o3^�#���������Ê�r��P�}�.a����+�|����>�C��T�T�5�H�|��o��B��E�!���������u<r�Lv3����5a�{�#po��q��y{dcLS �-�jث=�m��Y��'Rs��6�U�&��c�B?C����/��98-�g�b�3��4�m�s��FUߎ,�H��a���.&b�>֤֮�������J �������E�wP|����k���]`P\�^��q��ثrƜ�\c�8Fb��W��=okeF�=������ڮ����=��r�6�IH������������j�;���N3븶u,Nk�Ʊk���'�o�eE�� N�?�����,.ٱ����l��B:�a��Iq���6/ڄ���Y��N4��-��!�4y|6N���q|-��;Z�f�����+�u���⫯����@.�fo��㑺*�/P� �^ O��)���ќ�m�>� �2����Q�_BO�ʾNI����ѨE�e͟W˲�D L�v��M�{�<@<,���44��0D{�n�Fz��p5�?�>.�,�� f���5�W�n�Ejb��qL�T Xr��x&�ч�]C���2T$SV=/�����+_�+� D���&�N�$�8��S\��Y�o��G8a�KX�Qs�)��{T����xjZ�C���'jk.z�:\x*���?��e����GΏ#��ތ���b�������K��)̑��d9Ldx����5�χÏ�oa��KGR�Y�,����&_��?+Q=��*x ��Ɍ`X1���Z�9�����7ʀ�������{���R�p���-��dHg��VhT�Du!��UR��J��?R}ю���1 -���,u�^�˃��u eѥ;]�=�1?�DL��h������'+�Q{`"{�s#)oi�f����1�3������q��^��ЮXN�t��4*�OWY���ib���}�����d��}�8*�7�־�nfXe ֲu���!��_E\Ȏ'h]�3]�t��g/S��^���[�y�if)agq>W����E� if+�[���Q���ۜE���"�B�"L�x�*�ѭ���|j���濒D*����z�Aȓ���ş�'ͩw=�+�ש�`�ռT}�:B�iTz.����5��ʟ�'�1��-0ZL��U�F������T2 �ڳa������:'8bᦳ[Wh����Nh�:�M��S�*�Gӿ��!ʲ14������j¥>��W��g�P-�ܲf})}Aׅ�C�<���KRPc�V���)��t�`���u�1��{*���2����N�QF'��ߴ�u72[��(�0{�5�>H���ۜ�7w)w���s���h �cR�K�]�x�7PL�;��4��`���4�X�T�-��y��4��㣝.=,dL9v�z�P^06u���q�^g�DB����<K�� ���Z6�$�cD����Ǩ��c,�+;B;�@�P��ڛˁ#"|�!���~�r��x�����7�4s�j;U�� e0�t�<:�j�7�����P�����j��:d�|ٙ�>�K�L7#�'ef_�L���0;�+qh�ؼ�lg�i�{� B���͵y<��Ss�� c|���iO;T;�d˜;a� ,�y�����(b7�u�ۍ��V.��7?�dLu6��c�P�ص���u�A�[uts�j�f�.F��'i-m����d����aJ4�|��;�u�b��(�S�X|)ER]��T�?�)`��W��>5�.Kx*��D-ww�Qѕ�D~���A��9"���Wk��t�(l|B����2?ݜE|P.��bZ���5c�Ҟ�8jmq U��p��"X�K/547nS.�Z�����"���1P���}U�=Gxb��=m���� 9]p����������}S�J���Z����â���F��9�b��zB��H[i�����'dcI�� �<�˽���E�Y�<F� �Bχ�>|o�BN����.��8$���s�t\��ˉɪ� ������|/�e9����HrHe��5�n�>�a20Gx����>f�v]$����꾭�b��������f/���:mSpR��^C���Ƽ��%J���n�V���7�8r!�H�ai�d�����sT��Sŏ;mz�ߏm��>��ň����O�ӄ�:���6ԄH�Y�b?�y�VvRi2��!Y�eC�*"�i5��1E&������U�`�K �B�l]ͺ�J ��o��E2㰑��[O?LD;ПM��dx���h£�<}� ���`���=����u��t��������v%Ũ�/��gFL�G���b9�ͤ�>�K����^��#|���L��n�6��}:N�G�4rt�%�_����qzF�N8<o��)���!���O�.l�\���������Y�ۉN�{�C��<�_M�PZ���Ǒ��*q\�d�f��_�_z�:���Y��D=_/���eVY@� /$�C ��D��}\���$��҈[�[�Hl��2xI>k�p(g���z��7���LI/�O)������m!C�K� Vb��[�;�}�C�4�~�q y䈛kK�Z�1C�XG�����P�WN�$7�OP�t�n JQ96NÃ@����<x�R����������J���伄t��Ս�"���]9��� �m�}ǒϮ�D����t�v�d�����3��z| y�'kO��),ITvl�2j*�*8�I-4c�� ���b��W�[xT.uƲJt֧�k�4���Xn��?Qe�٬>/m*z�4j�����`f�w��G��--<������> %�k����vb�D��3�5���o��c�>�@!h��
Behavioral task
behavioral1
Sample
4cf7b9cc9bede060e9d56a25d21665a2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4cf7b9cc9bede060e9d56a25d21665a2.exe
Resource
win10v2004-20231215-en
General
-
Target
4cf7b9cc9bede060e9d56a25d21665a2
-
Size
388KB
-
MD5
4cf7b9cc9bede060e9d56a25d21665a2
-
SHA1
04573303e035bb513ea28b7e9819e3eadb89492f
-
SHA256
056fa0158e76a71f7e7a49f341aef476d55eda087393745ca0571033603b2b04
-
SHA512
0ccb741ece5eb61dc13b2f2a6010b695cd99775cbe6f7e22bb6730701344461911313a2d9c2462b2ab90d3bcdfa1ad30cbb1744dcc0b795d8076bb68fddcb36c
-
SSDEEP
6144:BvN7y3sl7OiLEkO2kt5N0zyRB+KgwxFV5k/v5VsvprIgtid6N55Y/OoySqvAV9t:7rzBOpxHMsvRIgIdh8Sv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4cf7b9cc9bede060e9d56a25d21665a2
Files
-
4cf7b9cc9bede060e9d56a25d21665a2.exe windows:4 windows x86 arch:x86
7ab8696401e7201fe23d5851f7d49883
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLateIdCallLd
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 316KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 376KB - Virtual size: 375KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE