���ѻ^�ۨ��R�UA@�=�6n���c����qNj>�9m��߄^ ��\!I_�2C���t��"��N��+289x��r���/!��w>��g.�-�=��̇�H��@S�.j7{���si�*v���BpX���ER���%����__&.��8�C�m��-�p8�uW�Le L[���|��]e���� ��od��6�!4�p��ȿ��Pa�m����i�����Y^� qz�"�U�ހF��������mh'�g���{�8i�$�ؑ��Tg�2��Ae!�]��Y��w�����@����.\÷/pi�y#����w*%G O��R� ���m�x ����$: ��[]�&u�eʣU�P@�4*6�������Hu��;� :8r:��9=~��Q1����^$ף����M�VL�e=���g+kz�LC���υ�T���6��ޚ;R�%��J�Zŧ8��5O����,t����N�N<?ޔ�mb|�ÿ�<��J��2�] ���H�ˠn� ��4%X69�Pw���u���^�j��B���`�ٱ)x��4��y$�;�fpS^Nb��(����Fq�}���Tf�Z��d��7[xn�Ŏ�ʼ�A�qJϹNY��N�"�Jf��,�_�E�/,G� ��Ow��J}a�y_6t܈��h˧���N �=u�J2ƞqm�Y���j�$��ő9�07Ho5Z?��vg�������G�0Sv��c���<��8��hlէ��Te/��}sW� �Xi�&��.���a F/�v���jYWb1�.驹 �/X'ֽ-���F���i Z��.[��Y1������!�j�=?a�M��z]�œ-�%��G�O����:_�T��ہb�~Q��^:�s�M�q�`�g���*'�-tF��Ob�dT'8 � |/��]��*�2������2`KN��P��з['<��:2��`R3�h-�V퍐5��Vu���*������#�vH��|۽G�k0��� ����9�����D��l��~t��u ��2��A�,%uK�md�������W$~���b���N[��/��@+��-�*TE�5�t�����ͅ��ml��q�W� �t��gGC<��a�O�/O�'�s顽�T���m�f�܊�8�r��ʿ'��)U6J�7��;Lզ��v�9j'�?pS�]?���4v>�$R��o�;c��'�,�㬩D�ã<���q�`�}G��3%،f���m��_�A�����Η���zA��ȾY�A*�p2ʿ��~��{k ��9��Ϭ�|�N�S� *��b�X�r�@nN���)�����nl�jh욉=��Z$M/s�k�|y�Ņxr��UxH�S�'g� ݣQ c� �V���u��� 9�������j�E�������� �k']FFMK����n�c���$�� +Ԅ�P$и`�����\ok�OũYPW�벜��"o�$1%�}�PS�p� ,s^�(x*j�����3(���h?ZpK�M5��Q?2�?s~�A�ȓ_5����ē|I_x��Y��^���!�9�.S�� ��{�lL\��&��`=&���2OrZ�0�_g.��Fk^snن��#gt.n���C"K*q��z5+���+��Q/=wCVZ���� ��@�_Ռ�خ��r�F�_e�Z��e�rU0�I������������Kw�:F��5ilZ:۬ă�k)y�[Iќ+ u�e�A��P�%�RG��8��'�����)�����F/���+b �F"�y,�Siey�G��z�S:��yTw|�1g�AB�[Eqp_&ױ�H�8��f��:���&�a�7E��(c�MO��,K���CK���N#^/ ��@?���� �)�މ@L��W���`�?G�� K�~�8u�,<�!�Ԫ�����uԵ�G$}�����%*f�`��`d��nX��elPc <�zu�����c/�0!Þ���2bJ3�� VPq#RF����� {}v\9W��*Lx'��@���V��@MًD�*�6X�@,[�{@3�Z��-^p�O�ӄ�����*��� 9fA��جI_�Cp飴kJ:���6�O�hp �Ҵ��@��B3<��Vɯ�Z(�+�;��s%+\œ$kLѰ#ſ*���|�����~�W��-�a�fd8t�KW]Y�\,�+�TJ�ݸ�Xե�.W�$~ �,�������U3 ��Y0aC$�����]͖�+h��He�09�K�y=���:�p�n�"h�}�-mR�Iy��xXHS�t*ŽԆx!>�*=�SMa�����塤c��pz�&�I9I��ʻ��1���k`�����(��i�� ��Y��L��d˜���Kj���)1fS���v��7��ɥ_Sc=�� ���q9�C�����^���Ī� ��.}�"� �4� ����H�.����>� �v���&���FZm�+h�:rA;����_�ʥ��dj_r��9���O�DžyT�����4s�V�r�*�wL�,�FF���c��:G9�������z��'0�N�%�p�̚�aӘ����^����S�}���FLQ���%��(�z�Q��&��>����w%�ħ��+ DO�APW�FRV��(r �2�.^p:�P|Vjm�C_�v^�#������� ���m���:��Py�`y������9͋�\��v.Ґ`�,� ��Ƙ�C-}�|_����ĝ.E;q]�IShQk�Y���Y���y韉�\ ���[Ɉ��j�����E8����r�q�w�& ,�a;�D�SS4@1.��}����>:�V� �y�����hJ�@lMA.�e��z<bb]Ј���[�H|l�n���|b�mG�����]�l>��<�51-�n�u�΄D_DKOA8� �]����j�RU�������������4П��Q}�I��L��V��ذ����%���o�,'��6��/� ��i���5��z���+�r�����Y�8�<�}�"ـ|�-�ݥhS�\����V�\2�C�|�~���:9vӍ2�{>!-��9�u�=�4-�U&m��
Behavioral task
behavioral1
Sample
8eddcd92cd3042c92bd53d0ac20deb3f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8eddcd92cd3042c92bd53d0ac20deb3f.exe
Resource
win10v2004-20231215-en
General
-
Target
8eddcd92cd3042c92bd53d0ac20deb3f
-
Size
518KB
-
MD5
8eddcd92cd3042c92bd53d0ac20deb3f
-
SHA1
5293ec118788b66d603bc5710bf5873cf4e7ec02
-
SHA256
49fdbb466af2648ccb0bf6854a0f398779780ab3e429b269bcc888509d478c8a
-
SHA512
41c95b74851e5f7c1d5130c377a473b3a26496f6ac4e0a3b46a731ffd557d3dfae70615689877defb084e81b77bee77ac2e35e15a2ed122b9216f5f57639cc8c
-
SSDEEP
12288:S2PDGIGLAYCXp7YDCIOwvnPWcwzwM+AMEDUG2kH:/PyNLArZwCE/ecwsM+nzGB
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8eddcd92cd3042c92bd53d0ac20deb3f
Files
-
8eddcd92cd3042c92bd53d0ac20deb3f.exe windows:5 windows x86 arch:x86
815a711017dc09bafed017ef4c710dd1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
RegCloseKey
kernel32
SetEvent
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
fclose
user32
MessageBoxW
Exports
Exports
Sections
.text Size: - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 470KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 517KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE