m���*P��G�0��L��n��r$���[�V�Ct �AH�j��������_:��]���f�N#b��5��7CASI���Wr�S��-ǻ��|�%?�R�l���{��\j���Tɂ����F�^�x���� ��4~f��%|&m��{�,������ J�U����iD�}>{h�H[�rQ�^�ӕу&��g�2�Z*a�f�=j���mz�,Jj�P��[�Ym�CM̖�W�BD���8�ր��%rD$����f���A����|�1��W�9�b�w!��d��,E��A�����d��W���z����s��ޝ�&�ǦnJx�_��r��+��z~��k�*�L�D�o�u��B����pv�5���c�)���N�·K&1_<&������[wClT����0i@��yV�{���L���L�JZ>7Mgz��Qmg!<x��`g'�I*������ϩT��r5+g/�V;�@!�e�`��YE����J;��`�����x��D�{ >�QuY�CP����3��E�rq7T�j����05�Ɓ���n*kv��j�k���B�N�:6�p�@1%a��|¢V6�XΊ�ٻ�l�e Zgd�lg%���C�d�.�j�W��X/�FV���]6�)��Rc|�2g �Û�a���J)L��Sxm�%���7ܤ��j7n�!��?�e.O��� ��3�&_�Z���x)�`�R�bF�Nr��ϰ�-��#Ks�M�[I*�'�x� �� 1�g?�35��60�����x� ����I����ψ��$a2�g'0P��2�:�q.P���XC��r����O'��1��O�&�v�HGO]�t}���u4��y,a �#�R;�~�(,��{jeȞ��fd�0�ǟ7�b.�J�Lg�q��#�������&Zϱ�\4H�J���g�wx��F�;-8 �B����R:�X��2#� !:�|/{�P;P�ĐNc�����;�=��1n�<e;��� ���%��":P#V��!F�����+�D]�i����H���O_�R�'�3�Di4/�~@�Fy���L��7\ڌ�C-�e�b�sM�;��y�p��Euw̟��[Ӡ�,&; =r���K�}x���!��0�r/B���У7�:�,�Lsڎ���.E>:ȳS�m���Qp%Q�祁�h�3rQ:�;�����L@@E�#���ڲ1����h<�|CZ����Q�?$L4��Y.J2��6�%ԛ�QC�R��s�g"A-y�����l}�a}$,�e*x�,)�c�-��n��+C0Q��1� c�)q�p�n�?G8~���Z'Y��myf �]�i�s�tޟ��/0���Un('̃�e������)E�����{�f��s��-|��߉��@5ۊ�4Kp4^��Waur]k<~�,y��GI��Z�p�$��0�����p&�����à�8xU-K;�製nUN���t��O��j��71�VHʕ �L���q���W/�� t���n�Lc�W��%6�ݔUނG~�amJɃG����q���u�b��Z�Y��!��c��$���i��j��q���fc�ݴ�9��@�́� ��z�@ !�&��Ij���}`�]g\�����'��feLc�n��{�LMMN+����H`�8_j�9�oAg!\y�o�����4�g���{�z�k|�G��b����w��D�<���Vw�tt�ֹ�8b6&��竭�J�J�;�Oe����cD%sN�����9"�;N����d���OU����SҺ���L�3��h���E�B�R�����̬�D�hKg�W��qV��m�(�U*=�>�������1��j�����U�$��m[!j�3�ɭ���6���+r�ʗ["y{Ѝ��rg��-1BC���l�o����'��g����Z�7{�Ƴ��GR`�h�8���,,X�~cD�}Ū���J��v��i��KAM���**e���]��=�@ǰ$��#�ؖ�p($?����F"$;Cs�d���89�@0V�1�B�lss��!a��0E���hQD.���T�L�}�lZPV}�:�N�=�Ks���jn�6��Qfk����5�@47��� ��q}ս�>�!4�����pW � @T���[�d��w��E#����P��t\�O=�L�h���6�����f��L��!>:.�u� ��*��`�٤��;�gT���;�(�!�;B��s�|�lB�3����I:���<.?�[��e��ue\Ŕ �vq��� �_Zo3�2�+�d(3�q��2j�k��|8�1���JR�h�C+�gs�k,�W�8�1Y5��cp�ޝ����g�t���h <؛�G"c9��Q�t�u�@����C�`��A�_�0 9����Ǵʣ�����T����a:���+��_���=4�o��S6��X3�i}�f,g~B�lϜ����[����~���%���'�/r�ܨ;~N�_�*������ o�s����`�&�[�*���btؗY��w��Vh<�خ��% ��l`[d;�R�����(�g2*3�� ��n ��������erP���ri5A-� �ïX�gi�p���5`���+5�9�9�;l�N>p9�,�v�]��|��w1n�^��r{���H�ǣ��/�䮡e�#�B꽞��ؾ �<�}�3���F�|Tg;�]^��g��GE���Z�G8��E<��6u��ʛ�)���νW�3����D_��f�ًq[�ɧ_^/|��,?�"�;�H�yN �'���V,C�E)΄&��]��5�Z�MegqOfD-<��I,Ry^��z����z�z���L��J�����L��G�wک*2���]d߸�+�v0E�>zZ��B��ظ�S��љU���˦Ec�nD�n5jca��1���`S��2bi��b�9tx��M�_Ň��1fd46��uU���Zt\f�~/~q�����nxZ��xz�[�]NI�p��4w����@u�%�� ��3���̐�0�����N�H� �I!xk�;�����ܦ���2���)�ǵ�o�כ��/mk�|��C��;L]���훴����M΄l]���r�����C�4N�
Behavioral task
behavioral1
Sample
7cd0d1e38ca412c4cced630b10fb6663.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7cd0d1e38ca412c4cced630b10fb6663.exe
Resource
win10v2004-20231215-en
General
-
Target
7cd0d1e38ca412c4cced630b10fb6663
-
Size
708KB
-
MD5
7cd0d1e38ca412c4cced630b10fb6663
-
SHA1
d2e508ebd469159272cc29e3968d7f457b9e6827
-
SHA256
0ae8fbd8cb0d13aa46c14fbedeeeaf0578e51289ab2cf354d48970aae27811ca
-
SHA512
42092faa9719f889ab2df538c0b96f3128a40ff6db5d4ba50e7562f67edd82ef0ccf01716f687001d34adac023376eb6547dc02ed9bac1ceec3b7419096eaf22
-
SSDEEP
12288:aZ+IqUXa5ewEvvt9aWjj7BJEaWnIbWuFEdl21ANxaTsZQnvt94j0M/:U+uIViMWjj7BPsxNBwvt94QM
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7cd0d1e38ca412c4cced630b10fb6663
Files
-
7cd0d1e38ca412c4cced630b10fb6663.exe windows:4 windows x86 arch:x86
d9729ef6a70d7e3341f8b1e8c262874f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord518
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 663KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 696KB - Virtual size: 695KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE