{.�iʖXp��9��z�V�Y��Q�C�f�-ӫ��-���r��9�Y���an�vⓏ@�ދe��;����Z�m9R�vf�TR �r�#���%#�g�xNM��B/�g�6��V#sV���,A-{s��A=�� �h9�d��f����D�$�4����p���.$}���,���S�yUGeg�C��L��:P+��0gN��Ø���/�^n��<pL:��+���a�b{��Cf���Z�UxZ!g��'H�c&�\7@�����2�Lu"b�{����v2C��i�.��O�/D�J/Ь��D�9yd��3!��l2�T��'~�r3�(*Qgͽ�*�%�jO^�g3�&��a��G���n��]HF�z�̹l���|��|v��\���{���yl��Cqj��.;�js3���S� ��^�P�]�3JW=5�h�DCy�Ht��Y�Ў�� /?�k8̄�(�b��0 ^�66�Uр���N:���ej����r(�բR�A�r���D������@J�����p`�4%����l-:��=���ѵ^��^@#�/���>ޝ�#!��AP;�ւV���\�(b�_m����Oz�@��a����i�R��y��c>i���i_�0�hy��P#���#t�~��O�'j��8�z�ֽ CE�}�^�x� �1+4 \L}^�Ԑ����,�)�Or�o�Mn��E���DCó�.z! ��/�˾2^8���EMh��s����>�-g3��6����i��G��@l�B�@��U�@�wW��:�J�����C���Y̋S����s�R�����ja%5���s�=�Ci��2n( ?MwK��u���֥ � <�x>����h��ry���'o�}�=���ञ�r��t�Xx�� �F�uZ�K���t�$ă[�UA�Ѥ*-\�����G�{�m31�`��XH��gt��3|���Z$�(�R�!�8��YL�rd<��@�<��!����*��X����*9��N��zQ��gbk��Y�� �Y���v�X.杌B���!#*~�%�Ԟ�=R͊��7�2��X��ρ��7,�!�Q�S��C�ր�����`P��12���١f$]��3�De�P�~a���a����E7t`�cd��@F�>�r����k�1�wq�w\��2K��"B)� w�n�snǞІ�Gn�Ⴤ]]���-�N��K]�X�`�H�W� �Ezw������f���������D�4E 'Ŷ�����<K�O�*A��5f����;�g<�Gn>�~�(Y��'<��~�nuā�h��éj��`��� ]l�wC#�@�(uL�R�������S*�Ud����Չ���@��s�ѱl���8�m��������:��Խ��r>gݥE�'W�Db�Q�y��NԖ�@ע��/#�Þ��쌎��Q�<���i���{6�}|�|���F���h�lMd��*_�ZGwnT_�4+m�5�;pH�ȁ ��GE��"Ӓq���Ģ�t%PL�Y����wH2Խ\NkP�1�U����%ٍ�u^p#KU�>���ҁj;L��Oa�����Th����b��Cܾ�:Fq�f�vc`�.*��sO ��tpĖ�➚~�|�-nj����џY~�WN-� �l��ģb��K�R���Q?Ptu�~'�W&C�tl�o��W�� ��j���yz�fL�#/T'����#����h0t���6˧,��CAD'����͡k߯��Z���zÙ��E�5ۿ����B���d.�hD�C��vm =�.��6�8Uro)WLD���J6G���Ő�G/�K�O�"������.RX ��Y��'n��BWfZ�V���d"'(���J���=@q���H,,�CW|���,,�Y�;?��hŕX�_ ����g�հ��|da��rI����z'[}����)☓��\�@? ���'�Xyq�@0�~ \�S��>Lhu�_�|�J�Sw�}�F�y������g7����O�rj�D�����o�NR[�|�r<���1� !�8�����-��c�ޮ�(��2B/J�pHn�=��]�����N$���Q����4TlJmGD��t�'�~FNY�D ���4�����+�s���*+��r(YD!C2��.Ӗ��&}sO�h�KJ�J\��>�Ղ ��c��0�����S����b��F�J�ڔu�L���Iv����U��% ������OB���1��U����D��Rs�{��������+q�z��1[�.��7�߈a����Cj���4R���up!t��:��#b�y����:��X�$ ��P�Ȉs��ʭG��F T�P���pڵ��$߃�b]�]������ԇ[J��$��f�(�˛�=���l2sxim�A,^Z �WK�z�<��]���;�z����3�5�~P�IZ��\4IH��tZ��\{l�!����rȫT�k��(�� �;�����n"f_��:^^�o�������yU#E뭐��蘭���},�hJ��& ��O���9�`���S����-��s/�3b���rws����h5����ިIfևC)�nM���W��g��|� :yq�Ш��7�A���\P��80J����VC�w��?�`�K��"6�TS��Ќ_$]�\�lx3�B$YA@-)���s.��������e��+;���$�)��oC�cTk�$DE�r=�tx�;����L�,�����D6R���y��nU <�?����X�QW���%q����M�@����`��5��},#"*(�"!���Dܾ��T���$�C�`�B0¥��44Ժk˩�⚼�ڕU�T=�8C�u�l{s?Ǖ�u�1�[�,��aK�L��J�O�2�#�ۭ�Yi��'hZ���,�`:n,�s[TcGQ�'��D��/�Q���OY��K��^ր����8��Mc��w���mw�c�+d��}d�ϪTQj�! ��d�3'&��(���{�j�hsf��f�f����9�˵���Yɀ��e`6R;�E( �K?w�mb4wg��b�|�5�h/-�w
Behavioral task
behavioral1
Sample
57f359196eff198aafa65aaf43262e90.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
57f359196eff198aafa65aaf43262e90.exe
Resource
win10v2004-20231215-en
General
-
Target
57f359196eff198aafa65aaf43262e90
-
Size
728KB
-
MD5
57f359196eff198aafa65aaf43262e90
-
SHA1
d44358bacea81d29937ce29d60de8fbca7fdc6a7
-
SHA256
cb69608d2e6a4f8d265e50a76d2d605c2d2f0a2aefb206413ace23baa11d5d79
-
SHA512
52952717345a39eaa58ced6f6de3c964e4e8a556bec68ed78824cfc084c8054e5036fe3d056a394e52bb6b57e62e34587f61a35e7f9e02ef7a7bf9fab494e9a5
-
SSDEEP
12288:9ktrnebg5tDAVbwbOpDdhi3rnNsgHuXQ7mex3k4ILWcOHMfst4vZ:GtRkoOpDdAJVHJnd0fOHMfs
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 57f359196eff198aafa65aaf43262e90
Files
-
57f359196eff198aafa65aaf43262e90.exe windows:4 windows x86 arch:x86
3b96cc438968a5c623398b292c4bf097
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord616
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 716KB - Virtual size: 715KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE