���cQ7F;��lږ�E����W�i=�>ܷ�v",͘3LG��jAlR#)4J?/,��ZI*�p_� �j���";?oײ�_�dE{z�U��d|���^c��iV�wOs��7��Z�ݼ���(�J5�n$-*��)~ � ��[r���Jv1�������J�%����2>�/i��1��t��C�<�������!�/�?3�NC{~�o�뿻��_�$��dT�H�C]���õ WRurDiw����\��ܐ�ί�����d���[ӛ�&7�R�Z�����t����}���u`�,�d{_ީ�Exu�$R����1�:�Hh�U���Jj(i�k.����XvT����)6�ܦsLEN�Al9�8V�p!W�w*�{i,�P}l�2!1Y�O��Îw��ۺ���"|ZG�mj�JXŢ����w��]:��G�'[�纤D�PEq�J���!]���!�%��~��������D4�:N2>Сş^�ҶMx�!i"Cp����夎k�>N��vT� *-jv������S�_m�h�K�����~���U��H���3AN�ߕ9����K<��]���>v��n�:m����m�r0�uϘ<se#�0�}�ݨ�19f�C[�(v����W�}�!���^>�Wٿ�>��8�\L�x�MJ�??�(넻�����,=�<u�D�kC�����r�·�̓����M�SOP�Z��|!��r������K �)0O"�X�s�W�����E z���uaa�������I�r8*�d������������Z��b�fG�'syU�g���ڝ=,�ڰ�L3m�v�^u����Ӿ�vӔ/��W Ö��'����o��V�{�(�����GZ~���{�6>�-�����V)(����l��Jc�o *S�D?��K�W%k�9~ˉ���W ���K?$%�\�%�)�%�ی�}<�bբ���1��?�����ޤ�b���0����1.�k�Ǒ{�YoÙ"��Э#�ˊ syn��pd~c���H��}ʖ}���Tx7{GΟ�ٛ9R����ԜM����C�Y6_�q!�G~���������,$ :����oszPx#Mxx23�ym�ݙ�1�v���a3�}EƕJ�re���q�d_^1>��.S���n��(�Z���X��y��:�>���{7_�Gכ!vh�r00WJ�.c�"�'�G��Q��L���G{���� !>W]��ӥ��8jzU��zy��D�7$j��m�)�>��C{H���2vh�5�|�F�y�]N��7���C�_L�N��aV9�sF�f4����C��KC夺d�4^r洑�N��Ԡ��x#�NtU��M �x���oP�P�Mܿ����)�i~�������*����!�F��g&0Z��!)�hő���³ǿqqN�dD��}������u�1�� ���/ɏr�ܛxΉ�>��2D����)/�tє�� ,Hxn�����⬺��|bi��r��JJ�KMBܕ�7X�س����C��O�H�+���٦����s�.��3�kL�v!� ��}�ʃ� �M �!m�������]ۿ��7��\�^��<���a�����=Hnz�0_�4o9���z�Z��a0C�Q�V;i{��N�����L����o����kQbH�}�2v�NJs{P������d��0������^g��R|hfPǼI�`�V�B����&�\���${�AP�� [rf!ї�.1+���6P����S�p8�J7Gs�r�g���g�i:�$V������*S����U��nV���w����� �VHd�Uq�:\3A+�#�������p�9|�-��ea9�M�?�Pg�ͩ�L�z`xѰi�9�ז���{���bU3��Vl{]E:J$H)�������M�gnp/��6~� ��).v�d[����>CpqÉ�i?���X��V=����Qv�h@�r/�>}Y�+8�2�#R��oա�Z*D��1w`�*G�)ؤ5����Ԁ��2m�z�u(�q��D����ע����!a6���# �'�5��xh{�����ݝ<$X���"�^<����I�6����M�c����nL�I*U�!��;hVW��r�����C[�Ќxp���� ��z;v%|��B����Er� ��9�m}��Oh�*h!BM��]�dy7%�&go��\��]>�Jw=�`�h_�=#D��EQxxK�c%�q�j����~��Y���ea9��SdeSȧ��4�\��aI�]�[^D�g �a�b_�ȑ�I��7���T}�d"E�nH�c}�b ����j�`��n�� �����Kf\�Q+�O��gs(���N�JO���XhT��˶�<x�G��������zt��ES깪%��w�8��"�Y8��w r��T3��^`�reF���\ �=��s#�,�Bd�[�����`�O���s�*D6?X����:� ` � ����w'!%<� �=5qA��fk�PW41ms��a_��Y3!UjT�ذ�/E��p���g�� [�F:�FO�sCٿ����g�i�k��y��,�<H\�2zq=�nɧ?k�����y�lFz��RUQ���-+7��� ���]�;���U�� 竓w��@ GV�*4�m��H|'�'E�+�aDU���@����}��5�`m0����0������.ո�,���&������~����焸���r��H��ꏄ]����l�7`t��-�6�az�h�9��9U�Uʤ �E�Q�Y���Zx�Tg�� ��.�����*7x��"�jD�����l��2�lQ����P�2��:Q�^�,�M�.����1ѮQ��z� ��aw�'��Ǧ�_�F�CL �u��t@=�%T���)� ��:i��bz�\��X�̱��ī��WS����4����ݟHE�NK���^3�B�O`JG� ����7P��[�SW*LyzT���^�a���H�ܡ��;'������E�Cf�%=2��0�o�N�V�ϥ�D0����6�#�-26��D��|J��q_п�$�C�������������S�'��ͅcw^"���h��6�/J�N^�����%�Ct0
Behavioral task
behavioral1
Sample
5a1e121f7aaf7db7068c4920ccafda5a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5a1e121f7aaf7db7068c4920ccafda5a.exe
Resource
win10v2004-20231215-en
General
-
Target
5a1e121f7aaf7db7068c4920ccafda5a
-
Size
3.2MB
-
MD5
5a1e121f7aaf7db7068c4920ccafda5a
-
SHA1
1ed0825548b6b02cc2a051700e4255db8784f2f8
-
SHA256
ea7293102864592d4fc56f6be50ec22948504281bcc120cd8e12e146d8cf3091
-
SHA512
7455a4c231b0686b44bfb6c9abffcfb5eb185c29bdfc33e21f12ff6124cd98457dde226ceffd4887c6f9bd873a0036ed5aa36a7a5823461b9cfd41a8c68b87cc
-
SSDEEP
98304:LdrNZop7gIj/bnLpKmNdEQcL3LyTc0JbPaNCSswvK:tIVgMnNKmNdHg3LyT77RS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a1e121f7aaf7db7068c4920ccafda5a
Files
-
5a1e121f7aaf7db7068c4920ccafda5a.exe windows:6 windows x86 arch:x86
84671cfacc2be8e5ef8bbdb83f60e89f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ResumeThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClassNameA
advapi32
GetSecurityInfo
wininet
InternetCloseHandle
Exports
Exports
Sections
.text Size: - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ