`���D>σ��[�A���p)�v*:��)67wsm�*x�w��Fi=�p��e �h*��5�eSW2K�j]���Lt9������tr����,>��iV:��{ �h�$ދ#)�l�x�0�7Qc�mQ ͉}�8�� �>�C���aS<��Q���O#��]C����![�� �� 1�{�n�}M���3x��aB�tw��'�a�ΦV0q�"�O{�l/����)�{�>�3��ycD��9 �G��K1L=q�w�X7^��;��}�}H��[2�c�z��^ �D)-=���8�t��r�/mq�����)Q`I��V~7��X�@����I��y����3z��G��/tr����� �@ ݤ�(?�;]��Iy�,�S/��W� Z.3\�&�;n=��C��<��]�� ݂*R� �^ �FJ�'�����[��� B+� ��*�=�l��@�6o�[Mi,qNh�fE랁�.ϲ��_��!V#�L,6��!�.k��(�si+�šQ蘭?�8�e�$�EWm�{3��jRU�LgF�I^/�n�yz�`�a]1��x���5.���lu�p�]������^��g����H���o:�ud ����T�cwn�Q�o��y�z����d�sf8�:��i�"h��I8�����s6<�Yև�Z����LxЂw�[�R�]�m�a�[G���k�P�([�,��7�s��D�UW5�J:45�W��tFEb1�]����oۙr ԃA�=d�4����@�)��������=]KW�D������ �6C�]����E�֎�xT�uO�5#�g~��B �/��D�yk4�+Q)$`Y}ϐ����ˍ�*b�%ށJ�%p �]^P+ YRz:�Oz|�^e���+�+0���Q��Y�o F����v=u�������'���|c�t��D��[���'��XEIPm}���"�m��������\��:�~}4TR�����K���H ����������]��kLR1�.��;8;F ��� ���17fYnV�5x��߾֭�5gMhq���C��̭��%� ⪰������Ӊ>*�)����Z����H ����M,�!��>� C�R��"�S����B[���-�I&20u<fe��Q��<���r����{@��=�-�d^���nY���i<��\���❠=��<�g�jc��Kj�g����Y���� A� N�����<���Z��タ�#B5�U,���H� ���r=�����B#u��N�5d&�,�@IsB6a����9�a�� ���נ�)T#5�4/@�?��<VM�������?[�2������|%B�IM4U!�g����M�M`�����=! )�+�tb��:�3"���ȫ�P�j)��#�p���?8������陈\�| J��;L��nlSL�hMY��n�:�GGu��b���Q�����Q� /!�v����ckS��h���Y=��:臄I�����vl���J\�] ~<��"w�ܰ��{N�!s�W��P'�i�N.`� 赦�f� ��"�]��c �-����;HE(� �)�z7;�h�����4o� ��h�l܃4�Nj_����j�>Uo���`�F�ߦ���d=�y�� =�J0p�cK��B�� �W=�cn� ��L����JL^�ʮ�n���YT� �o4�����ۊ�V��<IY�̾x���Ng�/�v�Ou�R���J�F��|v�ȕ�jI<��;K8�J��+� ��@Ѥ�{��b �J@م��H�y|��#�]:rs��Cn�ǽ�w;��fg���I��ݻ���]N ^�2�>�(.�*-�D� �&�t��h�lF��g����RYl)�Gq �<�.=_��rRGNM}�i�U����"�����yi��D*���騙 ٢� A68D�t�@M%�����,@�u�h(��k�g�Ө��=�����cMu=�IE��ʯ�����5}e���_.F�k���r�M3�/��[��P``�f� ���٢��bE���)H���:�F��{����<��~L��lv.�f��zx�/p��.Wa>�&n���O��ɞ_ D�(�Lc]r��ܴ:�.�T�n��C !��3�ڈ?�G!`��A��Q�R9Ǚ�n�\����z��S�����no����-���u@������O����Z��9~{��%�G��Ŏ�$~I�9�hZ$>��A�e7N80+�y>En�7&�F3p�0S�W�鷶Uf��Ĉ��!o�jTSn:�5�*)< W��GA���� �i��bs8�����u����Ѓ�B"m��O��ڇ��v�������r^��$�?��!� �҈�5B�]TzWF����(�T} ���Qr�g3��b�"�R$���Zi�]�ail�ӓ!$� �o�(�Rw�VE��B��=�����/��gv75�,��D�¶��S-Z�� ����JtiCl�����_��m�ϵ|��4�l{E��Ny��3��\#W�/ ��S{Q[�m z�R�Z̑LC�c?`9-�G��Ѿ�Q���x�+���.>h`�����H��*�ׅX2E�ٶ ?ݙB�QȲx��+7�u�z����>��ɤ11�������ځ�))����L�z|�W@uBD�sT�G����D�V�}'�ޥ����hX�9��2�-l�{v��X�#]n4Q>B�����gw�A�o��i���1��U݁������2���S�j����~b�-S.y���A@�Y�[ uW]��C��dq���ߵ����v�&#Ϡ.ʧ2���cHA�7�� (�4�~�Su�ݬ�碦N�U�Ԑ���&��6n�D���=W����K�>53�Xݟ������h���o+E0�����`��U�R��� Kw�����ѩ���Y�z�%���9gp�u�[MS��'�����}�����E��1��@=�kK&��c���ȃ��p`8��l�yr-�X�H9v25������,��.�@��"GB��7Kf�(,]�-59$e��ǡR5f�_S�x7�$A�t��oa����u�״\��L¾�b,�Hn�1�<�+�j=m5 �q\
Behavioral task
behavioral1
Sample
36e0fab79684ff011cd8eb889a47a100fca2759038067d8d72cd165cd5765ce8.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
36e0fab79684ff011cd8eb889a47a100fca2759038067d8d72cd165cd5765ce8.exe
Resource
win10v2004-20231215-en
General
-
Target
36e0fab79684ff011cd8eb889a47a100fca2759038067d8d72cd165cd5765ce8
-
Size
4.2MB
-
MD5
466765347e69aaf0a87e88695f541380
-
SHA1
3db891cea2e77f6ea16d13a5952255f34f95fa55
-
SHA256
36e0fab79684ff011cd8eb889a47a100fca2759038067d8d72cd165cd5765ce8
-
SHA512
9ffe948f1a64ad0dc964fb239146b412fc77752268f6fe014354fb49015a765306997d6f30c1a388584b8c53d8e86bb6ca567d98bb4f705782aae16f1743c124
-
SSDEEP
98304:tCBnO3V2n14Q9z6U8fZD5zF2NjnrG9u80rDWGGsGQa:IIo36U8ZHOjsu80usA
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36e0fab79684ff011cd8eb889a47a100fca2759038067d8d72cd165cd5765ce8
Files
-
36e0fab79684ff011cd8eb889a47a100fca2759038067d8d72cd165cd5765ce8.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 498KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ