#5�*��l� !xs &8B���1�]���/�6�5˫W���m^�ϊ�ϼ�)�?b�Sc�������r���P^�����!���0�V���S�AN�a��3F��1�X�� ��i��� ��l+�=��L��)wO���t����fqd(k�<��_~�,�:�������t7k�$}�9>(<��d1w��f��J����[3��64e(��yg�O9�~[%s��<�+��|jK�����?����,r��juN�m��wd�Mt��t�k�Hʲ�)8Y �S+=�ݧ����YR?�j�������>$_hd(�G2*�j>ul>=��DA}tV�J ����_r�r�{�%�fe��`��CB��'�u;p��E!�������X2~lC(:�����卦?�����5�k1d~��p?6��UD)�Q�dJ�(�)��6g#�����%G�Wr��S����;�15���I��J�X�SsQ̪��ђr�d1����{���?SH*OT��`{���)f���b7@��S��i춹�5 �8-����������RY͐��G�e�ظ�o�Yl�qq��1����� б?�`*ϔkĠ�eK0�3E-O?��(��0�n1�Y�`L��އY���5��R]-4�0v�yI�d^�����aV ��ҖbbC��ȁY'�����Z��Ͷ�ↀ�+{jޏ�����a�7�eO�<��C�B��6�m_ɂ�ƨh-rtm�*lOEam�Ԣf]QI)�퇠Pn��j��ļ퇌���'�EI�Q��ian��Vls�dy7Iϱ���T��R����{��ê4����{E ]�yP��DK&M|PxJ8�)��t+�-�b�E[���,�1<9����; #���v[nA��m��ё��X\� if��T<�JL�H��+,`x3�V3�YL:8�4s�SB��75ҩg����׳��؋�"�4�Ż5���ƽV|���e�E�R�C,��;�Oc��N����P��s��� ���N:�����ip�'i�>jn����.��}l��r8rE�i��7q����jgc��s{ =�VF ����U�ˬ�M]�7ɦ�m�9�꽒�C�ց2�7&y0 ?{&�@#6��w��E� Da8�cs�v�߳V�G�,_[�?2��/��Dm���#�s�t�0Ѿ��B����d�T�im+,7ײ \Nܓ^����7�rs4�+��L��/��M@�'��x�����/$k3���>�u#�� o6K/yje=)'!��8nR���)c��6�?�y:��s"o�x�A�'���#�Ო2��T<��� "\��U�-iDpS�wϿ�b�6X���w�#BZ��k�"����s�g@�ό�<��rI �� ��A"ݨ��$ԯ}��X*e�ˋ@%�9vҶTQ�C�@�Y��0h��h7Sߘ �,����گeT�{�h`�!�*qφ�(���.S��(�(�Y*��#���3rg�c�J$!]Y�s8��=;�����x�r؏�]���_�e��� ^ҹ��p��9� 7�6aQ���P�I��Uu���E�Ң=���l��'i�g~S�Pbļ���Jf�z�0<���k[�]q�b||�_��O�ӄ�kPGb�] T_�� ���6���Ӆ�����t3d���֠�e$خSk�4���i����8����p�����ى�����L6%��`�?s�Q]Ό�i�D>Y���P�ZO/�;X<���%��b���)��I�u����RÓ%)�E@8L�IԶa\�� 8�� �v�vJ��pr���5�A���p"�/L�B��� ���.����V� ݝA�2 ������2W�D����pW��HU;��V��<������f�F0}�#���8Ҳ5GҒ�u�j-�P-"xC�C3JB�4�D+�84�A�g��y�������x�N�IV�9�@���H��h2��oe"o��w�@�0i������jS�rn~�̾|�!�Z]X�*�'��!�8K��F��dX ��}��帮�:������8&����T���j���h��C�+8��r��A�e]V�I�r��h��!��G�:߭{S��. �����%��ti�?T5A8�V�iFY=c��F8�/36��:���U�RO�N������{ V�1�o���t��k1�>L� 6&J�����m׃if&���!ũ���r��߃)��,�jg��e� ��=+Bײ@�"Q�1��R\�2�� M����qՀ2�_�E�Rg�Q�״� ��� /���qS�r�~�eHJy!��@�f\t�e���Tv��� ��x�g,sJh$;=�{K���-�%_y�gx�miT��n��c�x:�=�,*��%�sb��ј�rxLHO��w��,��;T�@X����ś~���L"7K�+�=��\�%HU��/���+G���;/���8[�.#Z�u[�a�4�T��jr2�J�*�:�)U{�������Oa���_h��=�fa~�6�>y'���.���ޘ.B6��6��ݔEF�aD(� �nsƩ�)&�i0Org��b�`Q��� \�~�|� Ɏ��%oi���[�&ٷ'��!��ǃ�$��,H��(EY��N��R��S������{�D�����c�̓�G>���(��{��U�}o�R>5M��AN�2m��HE���G�9. �w�CHۂ��;l�����>^g��irH+b��34Y@��s?D֓��U �q�d;�'c]A%����"��a�y\jձ���� F�7��)��K1H1��%�a�ố�h �?v���q��v�"�91Jx���7K)�<b����H�Pu�k�Ž���d�gP�>o�W$�H�`ߒ�c�� �@�I<Rӝ�Q'Flo���@����K���=��K�/���D�{�p,�Z��N��43հ����1�50�g%���7O���y ����Dk�j��i���Wh���5N��O,�:� �av/$�S��Vh{h��|�c��#���2�>�C�R�O?}��-����ɍX-�� #�ڢsU��wm�b��Y,{��=�k������&�ЏT�y����~R��aQxK�I(��1�[�-�m��,z
Behavioral task
behavioral1
Sample
7d03295165bb5253694c78ad0f01deb7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7d03295165bb5253694c78ad0f01deb7.exe
Resource
win10v2004-20231215-en
General
-
Target
7d03295165bb5253694c78ad0f01deb7
-
Size
176KB
-
MD5
7d03295165bb5253694c78ad0f01deb7
-
SHA1
96bbb43ec9143e5750c91d233949a6dbb86634ba
-
SHA256
3791c5de6a0443db0481cc40c16231ca8515d0a54f00f5385246ecf5c3f09e51
-
SHA512
c12145552c7865686ba5323f2d7877865cecf31911834a66c3036bad782ea829a4505d188664c79c8924211600a9643f3f27a115601918bef920c414b1bfe0ff
-
SSDEEP
3072:DfNDxDAzSOFrPbWuqVqCBSZ531fATRgunoRakFmx7cxDKc0mc71e:xDxDAhGVDBS/tUca4MBmc
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7d03295165bb5253694c78ad0f01deb7
Files
-
7d03295165bb5253694c78ad0f01deb7.exe windows:4 windows x86 arch:x86
ed4df7e0790b11ecbdad7556455149a7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_allmul
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 164KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE