��ﲗg�m}�2_!�/4؟r=狾���� _�#nu��Jى��������;�Z�t�&��|�0l,(%A8�%�X�q���4�9r���S�)�����ˌ&1O��V�Den����I���6I�S���ݝ��su�h$�R�:g��)��u�4�i��U9&��l��&��ayu1s��aŀ=�1���_=m��z2�w`Y0��"ί�u�>�)��[��2��1K� y~��E[���Qi W8� ͧc��]���ѩ8\������Dt(�K8C�ݚ4�s�����F�[ڍ����C���N�Ld֜�I]��&�;��a�lGVE��S:�+�DZ��iu��Vic��ϒC�4o`T �G�L�X��r�;\��T.u!I'*� �$+�4�/9�*m}SH<jS����Z���hE�q}���``�Q�&�X0��]��N��`�^;� ���%=k��:I�^}��?���>_���T��oMI,���X�����>�ѓU�nYZp� P1Hێ��70�y�����ٖ���9�e(������������Uf�3�V�V�����ᒜ��[$��W���~���3�9E��2!�,����z��:����M=�ؔ3�n�V�j����!�Ҡ�o)ԕ#ao��:������!�}7Uj.��+�'�6*oV���j�|��Z��B�2x���Ɏ}��]����)�^����]��k���+����zF%�����c�ZF�+�I7˙����R�`��Т>��֔()SA��ӻ�&H�A{8�����ZW�@ W���MѷxZ �w@�B���Ζ�}Wrc}�#\��W���l�!8��a�p��[�B���b&Bh]���yP�"�%fB����H��kyFJ:�Q9�5jTD>y�,�����yB.L���Wƫ�ңNߍ�������Aƭ��#O맕p���AXm��sq}�b�N�z��������jPQO*}s~s^.���^��E��Q�\�pҊ7�rg�B~�3&��$�>x�J�;IŽ��� �Yd��Ӣ�X6!�;Ʊ����{���'6G���"�P'��N��̄�����3dD�>Yc��p�'��n��v[���T� (y�#��L�q|��t�d�������¯~����$��ϔڤ<������b��P��Sq�35%��լ`�`�U���l]����5d��'-���� a���^O�<�� @��^��Z��)��0���sg�����[��B��y�l><^���c�X�#z^�R��\����5���-l�w��t�&ӣճ=�PZuTmFY�6J�f�SN���G�� J��%/�c��89R�ʟmF�`���;T��8/j�h� }������f�ᣗ��~а������� hv;# ��{gҼ��m��Ϣ5�w�A�ij����S�N�kG�Q���(Q������|����%���υ*�Ky����������Ʉb���*�w����9�p���7X��5����0Sw!�N��1���Nڈ�y�I6���IR-ԭ����-`�3sR �Zٞ�^ rͥ�,��Fw�����}�=�ؔ��m�pm��D9�,�b�J,0ϊ�V.d�5�zƪ8����b�����Y���^�%�n=�V��r�������c��{���w�d]�]ٽ���B�)�JnLB��7i�I�>!ӆj���3G=� 8D��@#�M�N��/G�I<CqE�N^0葀ث���p��)g�E@x���G��8(QZ[74Kl���^�P��m���B?���j5!�L�H���kx�t�.��I>*���~�Us��:���W��C��.��_����|�ԦQx��;J����<��Q��mG�[�X3"b0h�T��K{ ?tQ+y��:����'���>z����j�����Dǹ<g !%n�n˙�U-��p+"Ƨ��+��lb�=ف��:8`���S��<4>��{���A"��eba�` ��g�2���ZuC���k��$��7 �EL\�A���� x�i.,3�͝�������t�O;�t��)�h�h�� Z��t$�g���彪�*��Q����H��v�#\� ��X?���=��D��#̣J��(J,7�L���2���/Cr>X��dګ��>�(�Z�r˜V��� �hF��@����؋yX]�[��]���hK��ЋLꏥ������k�R��4Z9��d�©5���2H=�=�зUD���*�&vN�(^t�����D��%��v[gQy��Z�����o�BO���`��y��D�#ަ6Tx[��6�`qF��@��y|LF6Y]�@p�{�#DS�[$m�yNjp�7<���T~��Ž����sh�#���W��|� ���O�Ջ�7�;b_"�j� �I����r4�)?��}vQ�DaB���������TU�s�3*�"x��t͞�r����!�ټ�>R�@[ȟ[�M�����0a�/N� �+ ����9�����՝xdM��$���>�s�v,��ѥ�F�F���͉3Vq1��O��0��(`���K<�l����ݱU�P2� O�@�u���<�ո�(+�ib�V�5���_z%��b�yZ��.��K[���)h���;�H(QV�Zs��G�=N^�x�R9!x�UUh�7�]�uʜ���P`�v�ן�[�]q\lv��k���K���ZX' s9�/;�x�a�Ȭ~?P�*�m�eGx�q���Q�L�����!����������=��m���>ln��E3]W�1���!��N�S0x�W!������Os{%�ܮ�"�W�ǖ�Z�:2��>����F����y:��aW�������j���ͭ �֑4 �fYJ0�� 2M,oD���&����J��e�F�[a��'㌉3�]��i-i���&��� e(y���k؍M5���ىC3^|���W$'�qAy<�@��"�L��$��C�I����J3�����l�b�:�*����T��0좇/�%5ւF�2!�G���Ҟ�p:Va����-X9<������g�P��D����<�Bb=7���ڹ�#�e���h+
Behavioral task
behavioral1
Sample
5a4d16f13e25e422c0991849ea519e8d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5a4d16f13e25e422c0991849ea519e8d.exe
Resource
win10v2004-20231222-en
General
-
Target
5a4d16f13e25e422c0991849ea519e8d
-
Size
724KB
-
MD5
5a4d16f13e25e422c0991849ea519e8d
-
SHA1
ca094fdc2820d3137508d6cbc6930706ccf40e28
-
SHA256
a490856dc6a9292e89401d0cc160274dfaa51571a5cf445cdbd9400002fbda78
-
SHA512
6ef0bf11d5e5cf5907dc293b589b684722f264457f51914b529b42c847b8dabcfa650f0ec9ae0cd02bbcfb56d0aaa0ab542c74da3aa62201ee2884caf9b9c205
-
SSDEEP
12288:dSEfWYcTLIjMMqWjjgyb8pfQvfZ22mi3Z026Lrmdob55I+cUg+YVHk+VsLafgSf:dSEf6LXxWo88uvfs6ZlQrmdcfcUMk+KO
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a4d16f13e25e422c0991849ea519e8d
Files
-
5a4d16f13e25e422c0991849ea519e8d.exe windows:4 windows x86 arch:x86
ae8224cfe9046ea609ee655b2ff3fb3b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord594
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 676KB - Virtual size: 674KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE