�M�9Nl����NHAv5���6� �%x�u�N�_j�O;r��w��(���C^�&f~��Bه�сȰK�F��W�p�A�\]�ޑ^��v��`"�����.�;7O2�3��2%��E��Z.�Q�Si[v�(d<O���'�I�~Ch���uJEo�x#�{�7_a�<�yk%�jt�}&�q5�ގ9&�>T���>�Y���r�&4���<zO����v�|7;���a�!Q�GPҨ�G��8"�1zδz�#+ӌ �W�F'Ո؆R�!mC�P��O���F�[%�ȷVw��!v��Z�?��3�L�����RE�W��$�.E"Ҷ�aՇ*8I�L�ރ�<�K��0�)j�W'�(_�w��:�Z ��0��͎��Fv�kLU�h�� ���u��S��d���8z���Q;=� �L@Pgh�9�������-����茙K�vjS�b!6����>�Y>�]���j� g�b(����`9�&h�c�VX}#�;���,��I��T)�ܗd��ٗ���'���B��p/b@w���OQ.� ��:�$rJBKԞU��[T�C��)��)��6��AT�ܗ��ǽ�;�$�ZX���B�Meΐ�q�Oϳ8���!.�\����a�F'efҙ\��ausA^�S�9��Z�Y��<;�mKs �Y��� ���<�\�*S�Ԡ�ͩ��5�*s��9LTx���F�1�}^��,"��}�R�iA�j�hJ��{���og�6��@�h���6�J^Ϋ����<�xӜ%U`>�J���d? �]�6�80�����MOe''kw�.�#5|C!�{���b}4TK?{UL�K^QL��tE.^�M~F��p�Q�ZY���S�RR����<p\A&Qލ7������������4L*ş^�A4~���~5��Y�A+��fr��QC���6����:��F�CK��T��2����=%VIgm�N)��ZX��ȞPNY��������#�Ŗ�<r"�Zs[i|��yw�'���~{�Ž@���j0La�w�$�C�ځ��y����8���{� z!�e2���'�o9ճO11�*(=�K���>�ptF�=:�V��عΕg�� S|�`�r�dt�>p%J(�����#�$L�G354n�<z����nm"����e�ă�~A�]��g��rJ�_~!Q`�aE��ӪC-Ь��`�&��A��v)o�����|�����G�ߘO��D��M����J�<� 4*� j�tc+o��S���d@��eB,=m���݂�yʨ.����Y�t����@�c��M�=sf�r��n�T�̑-���q'�I���{��Q$u�Z�d���@���� H����BP�?�R����9ӧ?����f��$Q�F�8�M��_3߱��X�Mdx6E�ӫO�h���$P-oT�ܤ�4�\��u��d���� � �D$� �������7���o��#�� �"@�|=Tp��EY%������*��)i��%{ 0��ttb���������^ϓ��/uާ��L�Zv�8�W �:�����>�hϊ���&�J>��]=A}���B�J&����^�-"P�3ߚ�����ݫ9F�#�D@s䃹o�Ғ�f�}ה�T���'��ݝ�k<wL�-)�V�A8���O����kF�i����~ހ����E.A2'n��č�3�»���I���gQ^�ֵ����f��u�Q/n� ��G�.5YR����}�y�K��7v�<R� Պ�ʙNڹ��Ћ*�O�f�`R�� i�PLR�p�XJ�����~ƈ���1�?CմG��?Vh*5��Z��a�=��JM w���\ڣ} ����ϭة�-�.��GD,�W�|ԍ��ڎ.���rۓ�L�s���̱�b�?HmҤh�q�^���y��E5'�wO������y�Lx��!k1&�� �_Pn�_M�_u��1�z��#~���������0��q�r�#�٣ven�j�hf�VC� ���O��� ���-�{�^������% ���?������[��Io&e�,?� �|��s(����Z4�'^���/���g��T�����U�=���^�5=���@����ى���0^�G�h����8�}<�J���>��:�F��I����?#���u�_44�vG/&$t���:8��Ъ8w�3�C"��7�@fni��QI�V����1�X3&:OIK>�f�nT����hr6D_�B�F�e��\�����3���T�ݎ��S)0Y�|3�>�?Y �u��xN ��y�(0%T?l��N��������5h.%�����&Z����}����i|r��I�'�����}�%�A/�(��?�UK�i<���\<�o���3�>y�`� Y��-��y˨膟$�X[��ez�w{gzđ���q3���g.���W��*�fԸ7)������(a��I��8:���S8����j�Ó'�4���R?�4���#-5Ì����LeL,��������'�[1oB ��|ގ�����;V�J�:��?�eH�����3G���`76iW�F�5�Dm��e��Z��_A����n"b ��;��b:�N��H�7ٿ����D��Ϲ��R'{H�*8�jC�]���'�런D���RJ�lm�ϳ�C�n���z�x��ؐ'��]W�`AaLۙN#�@�X�h�ð�A{�א�>+�$��3��f��dv�YX"���:���X\��-���[\�GN�����M�xg��ǽ�e*[���j�� �hW��Bu�8̚k!������*ԩ`Ow�sA<Й�������yA�h����5 ��x`g�A��d;�J����,,��SOD0���4�� �sx7q~��2��3�^�V&uIΕc�F������`%VcJϜ?����Ow�E��J��#��3�r� DRZ�2�j=�v�/r=�f�t[�h������W[����&�Y�!�QM�벭�L��\{a�������$XX�,�NA��ɋ1r�&��4�0��s�ghM�ߟ:@��U����p�t \�%��W6�������r��~a7�Q%��lE����UX�@
Behavioral task
behavioral1
Sample
8e7f43cd477e490ca230a7bab773ed70.exe
Resource
win7-20231215-en
General
-
Target
8e7f43cd477e490ca230a7bab773ed70
-
Size
5.1MB
-
MD5
8e7f43cd477e490ca230a7bab773ed70
-
SHA1
79e0646c609257d6623386a03084abd0edb8a735
-
SHA256
7cc4c932edcbf52631a8ca3b53761b3b30e6838a734e33a1d4cf7fd46b30c040
-
SHA512
b979df2efc04f6023a4573945810bbb848770671e868208e38d435884d8a8e035d3bf556489285bb9b2a11613eaa8c9c6a5fbe6a0fc8742859196bdcc2adacdf
-
SSDEEP
98304:Sx5iShvGv+EIq3nEeq/c556Vbrv1IM1P9G6ZUbd2GAaRY83xNno3qUU7oEMWek:SqSRk+3YnEF/c5EVbrCK95bqx3x9aqUQ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e7f43cd477e490ca230a7bab773ed70
Files
-
8e7f43cd477e490ca230a7bab773ed70.exe windows:6 windows x86 arch:x86
9acbfd9c2dcdf0a25ad21ac55f9a3f1c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VerSetConditionMask
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
normaliz
IdnToAscii
ws2_32
WSACreateEvent
wldap32
ord32
crypt32
CertFreeCertificateChain
advapi32
CryptAcquireContextA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 524KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 636B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ