�����+8(�r�C���L���I@-�WU��{��Y2����h#o2���0�� _�}�Hrx�]�D��T�{�dz<�.n&9�w�7����wSQ��sq��_�vP1�Q�R`�]��Q%��NI�"��8�<Z@��vB�}� �[�C��#���bU�f"�𦛀z�����$��B��.��0��6�>��D/u���rN�v���A�Q6'(χ��C���#H8�16(��Bu�Y��6���"c�hQ��UW $�h.'��t�(�"�J3u�z�)��I�ﳅ��._����ÛY�c��;�� �Ho FU�, EL��@�"�>e����"��;���鶍�hy�� ����#�:�7�F���{d���܍{�����m��R�e��Eş��6Q�V,(]!�ٷ�7|��������dcd���K�1��0T�ٻ��ŻH� �Y.��w�O���r��U�e������7����k꯶<9��N�S��������`���p�(6��B����K�H�^��z�{�����i��45ͣl����ۖ}�p��� �e8^d �<������q\(p$�å������kj�O�� ��;�!��>���&�jqߺ�ϛ��:�U��+�"DP�5��!�X�Q�h6���G"4F�?������io�t�nc��s=f��@�������LR�B��] >��һ?���+�Dޝ���\<Zz8\tz �X��H�CeQu:��ݶ{F�<BݪW׆a��Y��ڏ�%Y�{���x㷫Ñ�&'�7�rg�*��z T �uf�uR�;WHqg�J��$+��i���:e+jO?٫u�彊�����˛���W��'���O�h���$�Xq�}R������D��xdf�%�l��ӛ��O7?q��bMR�'���� �F��by:�T ��e��r<�B���+���"�Z�tZ`�F7�~�����\F2�J�5���H<M��`��4=tೱՋN �MD��o6�g"��Kz6mᨇ]�0�1�=3?<ࢅ�RӲa�<iȿ%���XX�7��¡�@�]��p������n�R���6��jU�����|Dƽ�!6g4K8�����}��/�K{q-s̓�{�◹��������&π|c��6���C���ߔsmx�HМH���k��0���jC�s�`8<�f:Sx�Q?�jh;:a�Ж|$�U�%y_S��߉P�Ώ� 5���JS���4���k1�$�_�a��6&� 3Ac�UBY���(n̻��Lc� �1g����"�Wt$��<�H����� �t-�;ȱf�J �,�멵.��9��˛R�>�%3T��ꖚ�`�E�L� $��9�9ʩ��.��C�b+N��4�$׀;�m�^8�Pjڷ{����,z5�Ԅ@�A��%�p�� 3������Q^�0�.����B����V��FSvA�\tp� �5ü�Fg����W�q��M�����L�? ���k����L8Εb�A ��R_b��� �#= M,�o#F>�ӿ�!%��c�k��h5_\��w��-��i�P�9Wr��{.�(T%fm� ��� ��f��j���Cs�0� �� Ծ�;a�RC(������vEh��J2Xf��p��Hlk���P��q�����Ξ&��}�&�t��� W�������c��,��C�5�� Yq����V�;���|�>���X��c>1��ɭ�2��%ػe�1��*/�{�9B8e�:>�ٜK��_��B�7IJ�;��'���S��I�d�R�o.�BUy0�>&$^�t�P�����q*}��Mdy�����58:iwq�,�5"�K�]-FU�M�/�� " �V0n��'!�YAS^��2F�-�E���ծ �O2k4�]��g0����#�υz����RI�:��R�sp[1N�����9>ֵ��(B�q6^�_�ylj���89"�Nm��J�`�ne.��r��b�~�{`8�P�im�Ͼ�7̫��s�H����B8' �R�����Y-�� ����n5^y�M�=��H��c�cg1_�c���B�G���|�3"�^@��J�컉�+�.�ɮ>��nO(�~��IFg�*�y;�������DIobo���ڴnɴ8P�}�O���[4�(���(�Q-k� ^L��I[L������Ha�zA�0vc���b5k�˫fZkr,����j* �}�?��G8���0R��[���I[M�%z:��0^w����+e �����V���ڝF�[������a�z�\�n��U�ĐΩ��:����"y�۟D4������� �}��3?S8��+?�Jo8=@C�_�(��*�^_n���X�V&�55�p���^es��վ�o�|���K�04QG~.��MT�8_1$�|�8�������G� ��(6�A@�'�Y{���16���a�7lp`m*�^a.ĝ���MB.� i�vD3�'�/������Gf��ˁ��q�M�0�xlc������^.��&�;�)%��������| 4�����b='[�b�0} ���t��7��^Ѐ(:��[����г}7qBA)�T��j�*���G1�7À��څK.��{���y6�>�ĵ���>�}�]�R� ��٣�\�����N�~̏?x�`;��d���c,��t� S��T!�P R�=/r��g}��O]��ɧ���Y�t�Ɇ��'o��B} #{�ы��k�L2�h���À�Dp�3����[B}ܛ��kt�Um���.�P-ܯ"λ���ǹ8E�ϧ��DI�#�D^Ƀh�DG\��U�NYl Gi� �c����90�*����n�Q�m�ֆ��^�=첡�yIS@ =����`b#o�ԋf�Z�>O)�lX�ʞ�D��({���`R�-�(I����r2�W4���h���J;Iw�����:�H��$G��^�Lb���+:��a=��j�3Bb��6���8ԦL���H/r|��ۄ��T�jHTҚ?0����t��Ӣ_���}pY�J�~����n��;�垟�xL�$�xi����q����'>&���i�_�
Behavioral task
behavioral1
Sample
b4aab459e17feef4b20a472497033c19d60a27dee2030ed519965f8ac10a89bf.exe
Resource
win7-20231215-en
General
-
Target
b4aab459e17feef4b20a472497033c19d60a27dee2030ed519965f8ac10a89bf
-
Size
8.2MB
-
MD5
396a2717d9d527f1b827861049eb5c3b
-
SHA1
a92bc7b5b198d48c82537332371887e11ae2afc9
-
SHA256
b4aab459e17feef4b20a472497033c19d60a27dee2030ed519965f8ac10a89bf
-
SHA512
c96fc0343b99f43d16fc7f032d4489fe9e5e6f0828512a57f2ccdfdf428484d3b8c7a448e465b29bccc243974d0d91de3a0dc4469c19ec5df93c7a7cef845d18
-
SSDEEP
196608:19IJ/oFfEWKgpF44Ov0F9YmyzZ4H/EUt:1iJ/oFcWLOvg9Ymyw
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4aab459e17feef4b20a472497033c19d60a27dee2030ed519965f8ac10a89bf
Files
-
b4aab459e17feef4b20a472497033c19d60a27dee2030ed519965f8ac10a89bf.exe windows:5 windows x86 arch:x86
7bc1a309a250666ff56bd9684615f1e0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeResource
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ClientToScreen
gdi32
GetObjectA
winspool.drv
OpenPrinterA
advapi32
RegEnumKeyA
shell32
ShellExecuteA
shlwapi
PathFindExtensionA
oleaut32
VariantClear
Exports
Exports
Sections
.text Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ