��#�'a�9���A�r�*�f2��I<��Z����ԏ+(c�������T�����E�ou�J��=ԧ�"�#dI��)�������-�*��̇M��C�Q�n��,$����L���xHF|~dsx�!юYn��H�b� ��:�נ5����(��l��=T^�������/A�5)kg���<d�_��pԼY ���n�arq>�5���!�<ba�(W������sI�0���T�a)ԉ�+Ս��۴sr%�i�nyx��<F=0I�Vڙ|�e'�����T�ɘ;���e�8��X��S�ƶ؞ ������:[VH=}�JP�@ᬔ@)���d�%��+�i2�Z���>i`1�t�<���ℼ�՟!�&%�t�[���� �|���CL�d]L2_k�)������*��R��ܸ���ZJ�Y��+%����"0Lʔ �F�@�a�Pi�F�}��w���585h���̸�&H���'����:���EP�%5��A� ��q�2��"s�u?D���5V���Q8�MkT<�Ҷ�%�}nS�7ͺ�it��"(�(v�~��&�&KŜzd\N��v��s(�x�w��Ħ�ԉP�[�S������X�[<F�����)W���J7뿌?�R�B��rmM��L�h���4a���i7#NuYm�E~��D1�b�o�NА�K{ɡq��{���1V�O���g��[�c����G���g�hwfan��u+Q���Wc^B7X�e�i����k�t��F�f|�_)�~.BuM���Ar-��O���J�Q"O]NIZ���\{|/;�.�)�7�?fc���{n��u����ӑ��+���4l�x7C�c>1]}�E������O�D�1�>BL�{I���3)&�����r�iY�{�2��j���;V���pN���Y�W�sӘh�e��F���G�*t�U: ��⒯�!�]�?��*L��Z�^a�C�ؕt���#,��o����v��S-s-}w۪�I�����B�X�+@� j� �n��Z�pk���^pT�a��`��@����՝JV�7n�Vw+ԩ��Ҳ7MB5h��b�:\*�Б�D�Q�Q�ݩ�9W��{֖D�PrOДe�K�vh�i��u�3E�Ds(vo�"���y�pު���es����X}&UDZ@ �Uk�w2\���X�B"�&~��S��s�`]�<�����mD\M��20��p�sL���X�S��h��6���j����Y�KF:#iamCQ�d�*RTlb�U�'��߰�\���N�d)�������X.]���k�ù�$��OfSV ��k��p�w c�!�In-1�Pb1,i�:�X�1�NSԫ��p��C�=��rb�^�5�hG�>c�G��|�8�5o]>f�f��GP$v�T�`�3��a�З#V|�,[ƻ�t ��1|�`��ZQ�O$x�����{������n�S)R+r�����r�2�K� �Kj�8F�^�>��u��R�C*Y�s� ��ԤAd����2̚����uX��F0�gS*�W(���Vj;O,�kɑ��Kؠ����'���2����Z���+Y{��)�}���¦�6�@G6 �wL��,&���is��=WQ�:��~�VV� �Wp�)1���f$#Ꮉ� ��ߒ�J��l�#���;htM��ޓ��A����.�Lc���vU�@�*�a��Po������kzk����.4��Sl����NC1y�Tw��"ov�t���f�^x�^��E��fK� !̇��{'�c��[K+g��[�Y�r�� �� LZ%Ჺ<���z��,��9�ve�D�t�w�`0�=�e5���Z��mCũ"a�[�U���`:��[[3�"��֦9�(��<IW��h������/�%��S�������OAr�J�;e�J�s�,$'xܪ���1����/n�!$p/�M��8��i�V����bVV-&�8/� VL-����W�s����*�M�sN݃/W�*,�����W?�P�R�-Dկ �!k�!��s��:�-Rl㪅� <�6OH[C��U��S�`�U-��K�wؕ�GB�L<��N�g���Z P���^F��.�f]x�S�W��Vac*�@���㳇�� ��w"�0�@�u����g/{S����:� LnW�8�Մnь���i.�ΰ�%!��(�ܲG�+o U� ��/~��)���m)?�wb6^<^y��{>����K��-%�8�AC���iY��'��Ƌ��z�T|��������ED����7�HxE���XF-�������.��6kuG'G�qR�q���\�b�H4��ܠ$�(9k��?�9��ճ���d7�yN���+�NW~A�{��8�0,_pU� ��n��Q��쩇��rgcN���)*�������������rbO���<��R���C��E6^*7K`RB���JV�|i�v�F�%S��wWh�*�: �:S�(��b��� [}�N鐒1���2qz�aPh/��)>�A����툳����q=]�:����=����Ad�[h�*�EP�=�$Z����Un�pǼ��v��2MU��!!{Ͷ�05��S��7I\��!�C��~�y�b�J�O�=���Z�^'������e9�]Z��R��u��JbB����%���7��r�a<E��v6��mP?���ņ�82���B��~i����C���lQ�Bb�8�BфV�I��� y����By���}����*�Y_� ���*������z ǜ2��6���&�1j�P��[�ҿ���?���f�4�`����VL�ӢI.�\�IƘx��z%;#h\�Ǭ�&��>G'�v>�o���hb+��� �_u��;�������p��~<���|�8�Q~Qu���4!g��'[5��Z˰e*�tt�%�\����μ�Jm�Z"I�o�S�K��*[�h��JC{���V��Xo3(�9��)$\��+��_Y��̉A *6��P����!^p�x�r��ݣ��>wdc�]Gg���#������Ia�p_3�+�|\W���p �k��[���S:l�F�
Behavioral task
behavioral1
Sample
e9a1a3caa1f947d0c71f1d1d420c2ed8571c7c66b36d564d729b1d66d04c3801.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
e9a1a3caa1f947d0c71f1d1d420c2ed8571c7c66b36d564d729b1d66d04c3801.exe
Resource
win10v2004-20231215-en
General
-
Target
e9a1a3caa1f947d0c71f1d1d420c2ed8571c7c66b36d564d729b1d66d04c3801
-
Size
4.3MB
-
MD5
bcf192952f90d03c5d5c9dbabae02153
-
SHA1
d5b0b5b0eed6d2b98775424b08fd866e9a3d8dac
-
SHA256
e9a1a3caa1f947d0c71f1d1d420c2ed8571c7c66b36d564d729b1d66d04c3801
-
SHA512
b7ea9f3e528b30de0e285585e888b748b0ba132b2d191ae214208d6956b247435328f6f145fe97ca86b973971c5cd69f7821f175ac20913a8623ad1c01c61b17
-
SSDEEP
98304:5pPH3sOaaoWLWgkE6FN8V7smDetuMvWlHv/mqkUyhqsL2F52wJR+:bfhfdCY6fssz8MPUYyF52J
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e9a1a3caa1f947d0c71f1d1d420c2ed8571c7c66b36d564d729b1d66d04c3801
Files
-
e9a1a3caa1f947d0c71f1d1d420c2ed8571c7c66b36d564d729b1d66d04c3801.exe windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
.text Size: - Virtual size: 941KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 503KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ