Tjڋ&��|�a_3^6�8覓T jU7�M��/gQɵ|��3s�NF;�d��B���ofp�b��s�g�Wݱ�x+G��i�r��r�*uZo�4�}����m ��L�b]1]��I��vV��s��p{����Z`�q��"=T����q-�Nh���J�j�.�V(���P@��<�n(t�O�t�C�v�ϊ�U_����Zp�a��*B���OZn'��v/y��/wRU������.�6����p������\2�is�t�ն 'S8h"��e]m�m�d�9+�XZ��ː#�֕^D1���C;}��7��A�*�<�t�4��BG����_�k���j�sZ�H<ZS$�P�^���9Ν� �Oz���L���~W�b�X�L�� r'p.��==���aE�s�.;��NRǓfMU!����N��]�<�����uK|c;6�a �P�k�E��n�v'f��U����G|�~�~|�c�{ؤ�X�G,6�T�U��rn 5��Gh�U��O��!�#������� �����#�B�w���"4Ԁ�K�.���o�B�<����� ��o�pK�ޠ�D��$gr�����������-���������A��U�7��a�J̧ڤ_�E%�;�H��P���*pT)յ��w �2�I�38w4g����KA�>���'��5�Q^���O.vld��B Y����>� ����Q"�N���ƥ�W���T��*�y�; Ρի���i=�o|�{_u{�4Ý�sbZ��=F�)����^G�x�K[[a���P�R��_x6��&@O%|D�[�k^�|�s��������}��/Gw��mS�Ky�~HZY[쭭�y_�W�ǂ�O�g�7X���� :O?av�,Ρ/#ָ��Y�b��T�e�ͅY����8�����+������G�Ej�i�'��L���\b���`�J$j"�m},�@���������M`������?��j�*9�W�nBwc��t� ��� ����sd���:�(�Ꙫ�x#���u�����o<D��I~W��m4eM�G���$T;�L?v���i-]��O ���F�l�Xrw�/ab� _���[�=R�b�S��l KU�'��ح���L*����ZxC�E���!�Ϳ����3R~ �`�t)U#p �v�S��&n�1�����UT�=b�H��kQ�4���S&���� *�/;�l�9I̱ �����aLI� �6<7���w�͙�2�i4��lӕB!��c�n�;�`�>2ڲ�B�y�U�y�Γ���*Ҩ#a���u��V����p�\�X��W7�%��Q�' ��m������N���/���!�̹QT)���ď�)��9q �ɑ�BrM�5���ݕ5L�l=;�:V���Ͳ��k���p$� �c�!ԥQ+�Hb#���D��5zp�lc�K�(���6��]k�oYďx��ԃ0��x��^�Y����ls�BT���ܳv�����}U�؆8�j����t�����e�z�!z*%��E�j� u��e�����e���e�rم)����G�m��-�K^��N���h���������琊 1�ov� ��\�h~�O�ɠ���z�saN# f��=$p�.ز`P6hNݪ�gJ9��;J!�Հ }�+������7�3l_�v�H/'U����25�¹�e����X߸��� u�ȋ\�p�%���?!2B7i��A�/�L9L�A�_"7�����p�$��r?��M�G�d���2 �wү23��z��5Ti�ӊ5������dw�䯇/��ZyJ�w���X��7�e�Hq�z�xx��n#T@a`x��y�`�-8"A? �I;��W8 ?�ϻg��y�U�L߸����t'<�~q�-ϛ��U��2/���e#��j��%nv��r�N�+kmk`�������Ц�X�4@"����@c�}�^EB�5M��d�����4�x��l��^7�b�ZZK�����b���q ��h2!���������S{��� _����g0{06�k�*���fצ~)C��<�s$�����P����.�e����)6k;`wl8���$�SC�c����#L���7=,���E��'��r}�J���7�� x5�����t���=Ԋ*���VB�zR���2"'f4���4T1��#���089��P��ܨ�o�u}��dV���z��2יKsZ#�=�%�< �Ȼ�L���I�b?��L@��ЮþE0�%�m�,2େ�_�w褖۷/h2|�1�2�)�sc]������ln�J_�=`@����.uK�h�~1!�Qx��*5s`;b��%,'usD�^qm Sl`�b�ɸU ��?�~�L��'�K� ��dS��ڵ��<N�v��<k@���(rnֹg>�{���4}GPtH�d�w�IoaX�,6 �,�A��/!�����9�X��- E@�"i]����A� �1� ��yac�W�1�ui�sY�*[�kaa����b4)�z�U��&�����ǿ� �eَ�Z��p�#d0��NK�R�l�Y%ē�*r�)�1�?���Mr���ɊW�|m� 6�^M�Q:z����y����W%�@(4j�����%c;����w@E�vO�|��۵���˃pk��×�L�����/ �C YWL�B���t [im���c�|b�E`��NO_��0HXT������ ��+4�>^�R蘌�������m���u��Ë�Ay}t{����&T�V��5s�G�x��%�0��ꄧ��ҬtB0ؗG#���M:�����=A4)Ys��=�琒�0�Ž���U`%BL�I��{� ZE,�1�T{�R�ƕ���O�&Y�����o(�)4�H6ҷ�ϩH)�F�� �]���⩲Z��ۀÊ���'����kp�[�X�'��m7��i�Jj�柏�S eX���W�>�6�P^X�6�}}U�x�M�^�!9}����Q�S���_��!�f���W@���o�䬢X���<�"�J�<щ1� %�TW�#�_\*���(N�iG8$��M{���%����*��}(VG�& �~������yX�I1a��
Behavioral task
behavioral1
Sample
6842535b1571257e9a14c2e37f620c71.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6842535b1571257e9a14c2e37f620c71.exe
Resource
win10v2004-20231222-en
General
-
Target
6842535b1571257e9a14c2e37f620c71
-
Size
720KB
-
MD5
6842535b1571257e9a14c2e37f620c71
-
SHA1
5f977329d7a15dbdb07c2bf3dbf125112ed8ea91
-
SHA256
ba83e55ca1303896053f936ea8769437d8e5f56179d77b33670e65ca6d048b16
-
SHA512
a7950a91bd67356eee259e242c9df931cb0438eb25f8ae0b4649fbcb20fa55647c0ffb2c9c0eadb57f27859d0c95a0c00d222581f2ca9be68ac2ef1a6e8c3194
-
SSDEEP
12288:MlxqT2TUS4Py09cpSUPtcrGqHxV8PQr91kl/rkCKSWgzFs1n3zdj96gzZPJ+PLAv:MlxqTCcKnpPtcrGqIYr91S/i1Deg2PLW
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6842535b1571257e9a14c2e37f620c71
Files
-
6842535b1571257e9a14c2e37f620c71.exe windows:4 windows x86 arch:x86
8ddd34fc0b375258f386d5acc27932d3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord698
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 708KB - Virtual size: 704KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE