l��́�]��&�"D_n��)%bj�H(����i��ݧ�����'iC�#�=����X�d�%m�+LI�$�,�g�8�-����t������W`j P����]^�e��6$bOo������>�@ذ���.�T�.#k�U7Y�@P��IqG�����5=w恌#���B�ՈT$.k�UN�RT�vx��XH��_����r�n幒�{.�Gu���@�'�Y\ 㲇���)�Y���+j��I��#Ն�ч7r�au����X�k�� ����D)pұ�<��?Ł�v$ Ko���ڦ�={t�+4VG�:��wDf�wo1��: �=�S�pA���B�Y���n���C+�ڇ�b�)�\��*�+ɘ;�1x������ +�l�E&?!��XA�i��.&����u��yqL���J����`�0_�����-� OL���9Ez4s c\�c�M���d��f��O���������㠘�ha���Hm�v�D7�r�W��i��c��aqi�3�>��"q�*��ӛD������99� R����S�\���! �aD-�3,�k�cΕL�5��F-ɯ����IeD^����f�cv�;G�x&�7\��{R$�hBD���R�W$IsV������!"�⼡J*Y�_��(�R�<,�U�ު�%#N5]��"�l+ك�n"������?�����P�ذ�!�� d��� �����@#$��a��A-�7�ݞ�B|��5�qն���`�}���HJãU�I�_;Bj�?���C�Ķ�ˎ:�yT����*�����4Y7��U;mf�G;�)g~�Fn�%F.�~���} ����>������,w!p5���w?%WBl�;!�I�a�SC���ٔ�4�¬W���6��ȡyO�Ɔ��bMtba�e��r�#&�G�[�?����y��E��C͚_!/f4H>�T1&��)�b��2���_�@�;�4��9�����B �P∵��q^|����2��].�Px��s�4�Ѿ��ݩҵ�l����e<#��,���۸}`S���� ?�@m��d�Sh���������dy Br�Q���E ;R�;������#{��F�|�6�(bPAS�G_�����1��_���wgD�jXw�dԡ%�lc�>c���O���#�!�v��^�D�l+�gՃ����\2��K��V>`�Z��OVm�a"vz~�&h�z����_�)�N�e����wʽ<�}v܆�7~A�#�uD��SE=��b:��#8߳\.��>��^�#��jYbkZbjGZ&�#Aɸ��wk/���V����JڄI���6�XDP��XU:������ �{��r�m���*_�����ax<�L>"�ݢs���y�i���'ef�Șl��=����R� �ĤR#~���W�$BC��� ��C7� ��o忋�mFϲ���4~�t���*iZ"�B�(�)PK�/>�V�/���w�U���6��Q ,̀]fE�+�x���ςCN�z�����n�E�_&4铭^T���Ʋ�bW�K��I�cd{�Fr;���³Z�m�%<��AhtB��d�:���vډȦ��]�Gl�0�� �1vsըK������5#�+.^�ɘ��&�9SU5��h�P�v�$�rے�d��z�,��r]�&"�>H^,��餺�>a�l�0)��f+�3�\���FB1���¤9;��6����P�FxuUis��^����=�K������!L>G��ɜr�Ւ�E;yJ��Dj�>�"�u2/fS�c�lc�r��vD����0GC̣Ю�K�� �V��`'����ַ�ΡF�OP���K�B�)�����j �_B]J�.�W�8��s���v������ed��HG�`O��wv}+��<K�Y����v0l���-� O��,1���9��oq����h<uva\��d7К[�5�(�D�OZj{�h��s�����?����&�U��H�?UZ���ua5��3,����44y�u��F��������is��p������:�-u��ua>�Z��e�㭷��3q����)�V��@� bȌ]��y��B���0��N E/0�ՍOKqSSW;_y����85~�V�}˄X��չV�z�k[�K�--z�F7`�M����q���b��Q�w��|ɭ��S[��S�5��:�V[є��7.ڄ��@E8%�`:.�^yX�F���Mo�&#^�dFzA�q�AI�vC�2.M������zw k`|���"�JC �14r@��6�Y���ZF��cU��N�?k����x�O�Ƨ �r���x���hJ��ѯ{���bq$sa�R�7�A��!���N��q�;�J_���S���)Sm��K�9_*H__o��� [��!�7MR�F�E�iL�!hJ��C��ӳh�tdc���獖�H,�U�צ�M��y����^kd���|������?w�l/��WCw)+�&�$��{�r��F3��� .��(��_Y����X�Z����xȎM7����L����w�?C��"o�LJ(��т�2�v !�&������J�C^�U%����Jo����I擕�}���jS�=���D��5�V���g?����t�}�����ipC�N�a�e%���Y�X��H-�F�NX����PU�q.�=b���iɩ�c�r��M�� ���J�P�&Z,��Vj�O���f<+%-��̣�*Ś���}�P0`A=b����9�0�vXR&��]�oG)9���>���-�� ���Y\9}��y���:P��X�\�ݠ1O�Ș� ݀�u�%�P� l��Y�\�dRK����+ң��f��S�)(�X*%�S4~P�6 ��H�B�Y��s�Љu���t��v6���n70��J�Δ��ΫV�%3zU��e��Ij�G���� ;@�w¼uJݎ���G�z�wq��v~�����<����CN�D���,2����L�C$��5*#�N&�f&�e��*�,�`��RH��MgI�E����,�K�~K�V?�7ͫ�F ���(2N�!̚��������*��j�Sj��Z7����?v�A.��E�i�Dd:�:�Y/��
Behavioral task
behavioral1
Sample
57a498febd16f8afd4dde68043d67e2c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
57a498febd16f8afd4dde68043d67e2c.exe
Resource
win10v2004-20231215-en
General
-
Target
57a498febd16f8afd4dde68043d67e2c
-
Size
429KB
-
MD5
57a498febd16f8afd4dde68043d67e2c
-
SHA1
c53b5f7884f8471a5257682a50f84873cd5929a0
-
SHA256
c487d84fb5eaacffa8dec74365a3b34bbdc07928b56aa16dfe353ccb32c23237
-
SHA512
be63b389ef3c4094579d3153b9689ee8ab42502073971e0a40026dfbbe5b894744701caa35e8f0a25f092ed8d1ed07fa1684cc7ae19fa4713eb088ef2304693c
-
SSDEEP
6144:R7+5+1kf15jxorFWZ07JXvOI1uWpYUWbH8S7M8Brg0G+zr84jSb/kUTHxPa7Rv:Qj12WZ0RNHpEbHHQ8BGw8LrlPsRv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 57a498febd16f8afd4dde68043d67e2c
Files
-
57a498febd16f8afd4dde68043d67e2c.exe windows:4 windows x86 arch:x86
f6a1094ad966827866f7a4b9c3fa2934
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegCloseKey
Exports
Exports
Sections
.text Size: - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 404B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 330KB - Virtual size: 330KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE