_��R��k=3۔EZ ��0� �����hw���� o�� �-C�cB�b���@OkI�Ա�� սl���!� Ԛ�s�E}��:k�o�#pP�] Bx���%��a��T\'�J��~�4LQ�����A �R茐z:P�N�[O�(D�f�Ė� �����V�(��3��F���S�p%�7ڀg}�]��F�=�)����z�dy���R7֥?���ˋ�c߱Z�>��)�I˪^�0E(�������Ė������U�.�`�S������\�(�����eT`�RB��b@�6M䎁��&[�IEA9�۶Ի~}�w�A ��;�m{���q�I��DQ��|�y����@��e�H�.��1�F��)��*�����@@�z�iC�6�8�M51��XZ��������UcՉ�8(�v��h`��o�v��͘w�u�C4�fآ"�! ���L`�Vs����[y��V�d��qg����|�7���[+������b)��oJY��m�4_X�y2��N���PsTn��Ӥ�!S�M4(�N��Ql����6%�;��ķ..��)@J=�A9��ʇ��E��,�P,�u��}�H�{�p58�<���L�0^�o���R�7���*ڣ�jv8�N��@��f1#\�Z9 �{1w�P��zW�MӰSܒx3 ���,e�*i[�jF�z��K ��na����8K���A��!z��9�(�ʃe��T�2�+�9��I_�lO�5ʶ�wPd� �9k�Ʊ�<V�������ej�ůp�0j�3�Cc�M�c�����Q���aJ�R�ƿ.'2/l�9ѫ�qeK�H�4+���j�٥k9�����?JӾ��"l0�l�������+�ޙbϰm>���S ��E���z����#���/��3L������>��w�qiS ����@`eǙB6��.U��q�R5vXz�W��>Os[��e�m�M��KHh�>��)�>D���>):& O��8�����[2ph�+����L誳#���k�V�=^w���풌�){����U���&��ï$��R�]1�tVu$���������F�o���%A>�I[�� _%E�����)���&�@4rU�,%��LGwW{#nx� ��G~};�vG�K����B��������Ŷ������~�>+�"���d_&���Y**����g"� BGD����FI�a�%��_�c�W�FPB�s� v��ޞVL����'�Jt�5�BT@C����'���wQ��e�~Lb��Г�X:$�����փd�Aha�\����4fʝ��͖3(6����]=BO�&!�8k���l�.�8��٢����i��K�+酘��� 0dL D���C*l]��7�7L2ks���Ņ����������4n��k���K 7�v�Rǫ_0��`���g8���Y)�&~�6���_a����Α�BU)�p�{����ߓ�pTd�TX��m�87L��A���Cz5��(\�C�Jٍ�9�p8��}S}��W|�nm�'�T����j��;*�����M4�1'ƍ����EY�ڤ�d��A��NCf.���c�1N V9.r���x�eH��Ft*��e�<������Z�qU�zQꠊp��q�_��U�"@��T4��s!YAN+H&�Mgq�.�ڛv� �q��$A[B=z:j4�0�1_��*IJW�aj����s��w��j!ܫ�) ��~|���4�=�g������\�o4��M�1�yо��7�������;��kc��aE���V���ǥ���#m`3u�z+ iu�Z�e��U����!FpD$c=�*b���dXk��C������|���/&���/��{��ɞ��ĵ S�.6�M5r��H��Z��M�_�*X�&Y���ݻXN�}6�&�<`t�m&�)��m/�Ω ��P� �����hҝYH������� K0��tg`�w�?u���_��O�k���c��dq�����[Z����P7w�1̗�1��4�Ʌ7����1�p�E�`�����qĘCcβE�1E��<#o����}oJΝp̱�����]o�dpP�[�2��U�?���9�Y�,����a�DLz����zx���Z��Z�=xL�'p���<���$��'������_0��U�أ5��8.���#"x�c�]2څ�����O&����-VEU`���l@�5ښ���?����K���)z�4V"!�a����yg���p��a�C��u#�&@��BqӘY�Q��"/�a4HE�1��Y��9�۳V�u�H'�]�h�B���:b ���:�� ���<L�yl�!G>�LT�s�F�v��CJ�+�g�ni3�YgLpSn��0EX ���H�3x�G�$DO�X Ká�9X��� �T˒���"�-r�Ҽ�Gr�*�t���9�3���b�Υ���l� ��D��|� ?�A���U��s}��1� �����R���E�"h����1Y�MP�c�s*T���ʭ0n�IōYE�e6k� �!��%F"�94�L%֬ѾA3w���ĭ+� Av��Qbo�)>Q~L�9��u�!�]�������իצ�q�,�,$^ΘN���ŧU&B�v���4��νq��r������S��|��� 2v#�x��!5܈~݂y^�3i{�#�I�bWII�I�W��*�������;�VR�3o8zDo�~���B� �o��!w�}@��~�JD<&'�o����8�Eb�_P��3�{�EeЙ�I�jj<�]�!3�����p�� ������#b� �#A���Z�G6��^�Y�I5MkL�-����d���{p�6F��4�l�ˡ�����hB>�ӎv�O�')���'��@���T��Ń��R����h^$ ���q��7�46�rI��V��3��I=l=BQ�(��,�в�\��B�c>R&�X��������ݱ����e.,����uZ�VV�����$��!m���"�Xo?�h8!�!�{fS85���/��0ڂI&ܩ��}���@�ڠ��6�hu���1%�Z�e����h ��c��gIٝ��fhj���r�7
Behavioral task
behavioral1
Sample
7aca6abda181451b3a1db4a49028bcc6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7aca6abda181451b3a1db4a49028bcc6.exe
Resource
win10v2004-20231215-en
General
-
Target
7aca6abda181451b3a1db4a49028bcc6
-
Size
744KB
-
MD5
7aca6abda181451b3a1db4a49028bcc6
-
SHA1
97413365bb5fa1d3d2c307bd00572bef07848afb
-
SHA256
eddaf665b165d3aaf5bb05059d16c0f59f9e6e486f5892914608d048c299fb8c
-
SHA512
74d47bf73851d729128030a98ab5df37fbe289d2422dec16f6e6a96caf106e8cddc2a0888dcd37b41f1cf5b572b0185c43f469e3e2cf4cd1fb0f7dae67af28d3
-
SSDEEP
12288:c/AwczJXt4Yr1Dg2qW3BB97Nq6p7kZACLTQFzHtJHJnYawOPK5T5WfDnSu/LFsAH:cIwczH4s102XxPN99W8bHJnYKPQT5Wfr
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7aca6abda181451b3a1db4a49028bcc6
Files
-
7aca6abda181451b3a1db4a49028bcc6.exe windows:4 windows x86 arch:x86
79ea7d6dc79931c5fc0e62543db746b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
EVENT_SINK_Release
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 708KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 732KB - Virtual size: 728KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE