��2N���zӷ�u�%s���Ϫ�k���VX�yP��a��L-Dn��I��AP0�E�������N7�X�w\ Ih4ƃ�8"oy�Q\��@����V���N�3L�� ���B�U]�nژZѪʶ_E������!���ĭ�'� eT��B�n��I�H�?�aM�gm���M �I��ۋ<��7��Q�u-�����ZZIxcș.�&�8 ��/:�n�S��<p� °5��@9ӡmMf�x T��ԁ:��q���1��w��� ���� əs]dm��\މvV�K���Z)_�^X7!WY�NgS0����&�ڴs�����E�!e@�)�HdF917�U���!&Aa�n��l�l�,���Xԡ���6���i��EQ����Z��� 0�^�39�J'��ǝ��r�\�����,��ՎL��7�yW9�����s;U��q��C��+F|w���#t&�S$���Ƀę936U��lG%�4�R�p*�ko��� �(omE��,'ָ��kZI�cٙ |��������6����xv݆`@��[�^oa2D��Z-<�ߥ��8+v�z}�"���\�js���S#�m�a^$�TE���R)iX�_ܱC�V��n�����k(��%���?Yڴl������$��/yH.�O���쁬%�z�p,�����?7�6y|P��_��{H��o39"�`֑D,�O� [��p���̣.��Ֆ��H]��"������g���9ڤ4��:�ڻ��T�`�架 ��9��0����)��D�Q��0:k�¥��}p��kCM*�'X��0�:^�OB�|�@>���оCS��dl�����������$�<;���$���^������X3�9����;+5A��O�Vq�M � �I����Eגw����������\�Ј��\hw��ހ��w姁��� �/�z��$�5�5H������ki��K\U��$AT�<|�c@e��7_�� k��E:Q�C��V�v)��]�P*���)��Q��h�ɇ�-�rj���X-爢�|A�*����E@�%�i��j C!��\n�������=�p�f�Ҭ�O��2p{�l�X�i�,K�Px����Ace!)ª#���s��)�#��S��u��(���� Ø�Q_2.�f%>M4���}z��(n�wL�02MXj�l��@b����4"�9��)�0�`=��=�i�P|���n+ȩe��QN�Jo���}ŮJ�/�>��}6J(�tE.g��`L�Y�'�5�(��x�4�Et�����*��nEw�h\����CKsG� U�������`�ƧQ���Y���adяRG�ڣ��gP�ƥ�t`�1��J���E�u�n�b��E����Y@N)�nA������w'qJ��_D�Cۋ�Yeb%qx�g��ż�s��������,$gA�1������hP� ���z�4�n+cH������X������i��� &�����5Xi�EX��M�-���E�����v��ʂ��v��Ra�J�ia����+oQi�ɏh3a�������BDc�^w�f�^B>w�����y�U�2����jŰ�E�ܓw$&��AЂ�ӷ��D�M$���w"��g�!i�c������~���O���H��U��:�6X`-�`���&��"�,0��2���%�!%��)�V���;?4W���q��D$����L��HZ�C�\к�T&��E�}�$ �S"t��#OG�%���vw�f^ߟ�Y}KoyŅ��#y# b9� X�r�,z���][nB�NQ��c�L�R�́������*שF��G�t��u�*D4uy'p �8�Ü��^.�]x�~{�2L�{�����;�����3�5�Pd#5\QJ=�Cr�-B�?�/-ׄ�{R���U5����;X�F��6pO����|��u��#$M�g�E�g�_F�+J��o� � u�T=�5�:*ߪ��g'�z�F�u2��B��'q1%�FẖC��21Yf����qy����X���-^L_�KwLG$F��P���;.��ꅭm�"n v}�W!_摌���UǪ_={Ϳ5F��.�Dp�KA!4�����{ݵe&�,�Ȇ�Uk�J� т�C�8��������%S�35ju�Ŗ�Y��<'5!��7�NBއ�,�b*m5�G|�]cl��a��@��W:�٭�fßYj��'k�!��/PR�Ǒ��M�B�9=eB��[u��� �Q?���AN� �j4�f�p� ���\��p�U ���+I"���*Q���"�O�d�]\����m~؆��1W~{ݍP���h��ab��r8����x����/�+f�hܴ��P�0��2DC���Q8�.R����3eK��ˇ I��ՙ}"�kKg<�<��iӡ��bs�c$ *t�ȃ���>�IL,��o�~P�=�N 1}�#e�������{��;�3�t���\X�,�����}��,��H�E���]%�*d�K�E�����6�D�#uF��0F�~�f�F���s�b-fϠX���{�}���#6�H�s3.�b��U3�sN ie�J� ��)�,�M����l��22�S SB����f���QvO�z�c -�}�ZP%��}���a��O�q8u �'�iT��w�S*:E��si�p��_r��v'�٨�!�_q��=����54VaX��dh��� �Y>�(E�Ϭ=�,2Ӂ'��s{3G*��P#{G�Jv3�Wl�|w���C���W�k���k�C��♺ۃ];��j.���o=y9Nj �}ےƣ�M�w[�ſ��*���2��e��Kȑ��L�MV����1SG�w,�ud0' F�禧Ս�`�#���(ځ�H�آi��}R�y2��>ewE�/�!o���`�G��u�� 3.l��3�-غg�-&L�>t�8�����嵹����d7�Nh�Gr垰v[�D�!�o�����j���xX-�ׁ��Y!P�|�H� �F� 6�G�Y�d�X�{�LA5-w�Ѵ�S@>tC$�Gq1?����y}v*�\t��*���}B&���
Behavioral task
behavioral1
Sample
737cd180257bbb869a5f7812dd35435a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
737cd180257bbb869a5f7812dd35435a.exe
Resource
win10v2004-20231215-en
General
-
Target
737cd180257bbb869a5f7812dd35435a
-
Size
732KB
-
MD5
737cd180257bbb869a5f7812dd35435a
-
SHA1
e13ce9d57dd654290011e2b8b293ea3138ecba3f
-
SHA256
53c210438dfc6698451e3c94c5a96a4557b4a4d173365b892e6ceed80acfa8fe
-
SHA512
cb2065e5aa76003d63213e469353f572065f35d12d28a1135eb09b06d02f7c57b564a6d5aab70fc774b5c04d2c4fef21be650bf00b393796e58cd75f5afa9c0e
-
SSDEEP
12288:CcEB3cxOO+Be6LvyotkisDF29hKKW/cTaVAJ60O5SEs/kVdIjOsCBtVs1x:DQM+BrjtFG2jKTkKAxms/g+afG1x
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 737cd180257bbb869a5f7812dd35435a
Files
-
737cd180257bbb869a5f7812dd35435a.exe windows:4 windows x86 arch:x86
24a0eb41b5fef8395c6da74d48a3fc72
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
MethCallEngine
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 671KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 437KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 720KB - Virtual size: 718KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE