�����%�>�4��+��"%���FA� �u�BF4�3���W���-#�i����o���֑�iHoEɍ9����$�)Knm�*���8c~�`���=0�/Psm�ٙ�dv6tI��-݄]1k#��µ��Ϝ#c"���g��:Q���.Rg�V�!AʽF<���j1�b��n5%w���r�����������̂6Ϛ�4�����dU�H������w� ��R����t�x;�5H?�����gf�!XA`ҵ�5��;c��XJ>,Ni�损�Y�SdF��'w��� �ܩ�3��9����3��X��L�������}���7�_�u�4MK����K�߫ ��7������u\Vt�Ж��4���k����#:��]��KmPl���y���!�YՉ��a��'���H\�H�7%�ߞ��:�U��%�����R2�Kk;����V��3�dS�m�~���?uD�����g��"n�_��j�=�#Ď��3����y��>�C`kιh�^mc����Q-��c����q�K�!�?��7܊��-�;ɮl��z�m[���Zn�d!]̔��7>���ݰ1x҄Lpߍ�R9��cf���C=�Ti���ed��c���v�fC�H�����H7��d{ �I-&zU�������:���)!������VI���6Z/.�Y$,Ui�1�����A�?���ǐ�v�/�[�x������CV�V�IC6��H�� ێI��2�t�\���~��Ӽ�2<��]n��� ���B/H#k�Mk(����h�a=������9��B�l>/���W�cz��ǔ&>�U ��o�n�f��` �?��"S� uI4U����@�J��il�JCxm!��t/�3g��>��V���L���qy�&�>�X��Ň�W�?='��w�����DeW�٣������t���.����H'�o���iB�P3��A���_z�����n���ofvI��eI�k�ua�����z�#Xk�w�eu��ˤ�jD<��c��I����m�l�����(��C��g�/��9��2����-�6�}�f����rb$��1��^�ei��{��F�}W��]��6D��~i�zA����3j�� �x��d��Q^������4�|bop�`^%<fc7�ZY�#eS����VN��<8D:�# q�R��-*\u%�~=]�i��9Ӵ%�k���>刕K�.���^*X��P�X�R����CxҖ��������:��� �Xj�xB�f������ ݙ��wZ��vH�JZ�è�# +�7�1yC��eI2;����ţТ�"=֖'ɠï��$|�px�u!2Q�=v�55�����bպT���H&�^>�+���u�n���� �F5)骪��r7�U��Q(/����� B��l�aE@�Q8^��`7�o�R���6Z�r��?�g-D�C�;#���K+������o�|d�G��s�K��w�����ݼ��ᨳ���U���>���|����t�}*��_ �����}��:r �S�D#G"y23�����H� �d_�Pl�j�8�\��[��n(��܅�m �8���7�et##��f��ŋ=~쏉���a�צy;���7���g[��֭���U��9��-��[W�� �>���*cq��x�ގ�6�ĵ�����)���p�9��ǂi�k�Ɛ����㔛1�!!a+d�俐�"ބH�i'��tFi�4����*\�!�p��='��KT0!G��|�K;���uD�����M������<�=������鳕ܯ�'}� ��N�u��]�K�k�6,-���Ɏ��m�ltq�� u=���%�X��(^��A�����B����&D�垣��(l� ���.���>� �'�] �=nT��-,�m�ksk����r�‗pN�m�ei�zB�d9�ֶUx�1)(r������Z$}E������yˣ�lI@�f�Hg_�UG�a/ۼ��T�8Z9���ՋQ�*�˳�U���ۜ��J�-�Gߐ�`+c2��>����r�r��cBV��7XDc��I��������`��3��+���t��B�^��g8��Ǎ)�9�~�����������ˈ� �-�Q/9�3����n9��-�� 9�G���q�"W�Ъ?��`�l2sj���W�����" qa���&�Ԗ��.o��+�t�*�# ��#%�%ro��P�q�AX,�`�[����oD��� u�m�횖�Z��*O�R�0C�#T��#Yѱ8U@�s�@��E�������c �%ɨq[�Ճ����4��23?�^�>���\��'}q6|�ف������ˋ�9�{��Ie����a÷|����7j >c��HEj̽~p���d�d�<3Ra<�ə���L鹼iDB��� ��$l����Z�p�$l\zd��:�I�!&���X3��_���"p[�QL�cѶyҵ�����{-I{mތn��XW��=�}�0嗨�x8vJG�+��U9��x8a?��C��4�.����G�=+�P0�� Q�uͬ�����!_b%���߈�Z���l�4m�V�0O �6�?�[xJ���t�z�b�r��`���Z�[�� 'mlҫL Q���-,?ȴL��K�����ݎ�:Y�h���,c�zi���n���F4����9�2�j�9ß;ѓ�÷�r�iz��������n�sJ�9��g2���=VrU�y@[}�j� sE|��0:ͨK�胨l!���Ӭr��9�#��FE���*�8�s���^=WƏ�x�p|J Y,"�$�2jz/�`g��;�� ��{Fw �\b�k�`�I����/�&�����m�8M&�Ԃ�9�"&z�B�vń���X��ܯ�=^'9���U���¨9��[�����Hl�UqL�������d]�,CLՇGct/��V���"i��.6���ۙ�����9O;�#f@���)���v�<܁���t*|�&j,ǺM� �u��"̹�]�Mi�;]y�Z�j(�+ӿq Vz����O��Ι�e� �m$�6?'��n�>��8�D�8���ū�S���.
Behavioral task
behavioral1
Sample
97600535747313c5f653faa84b1db5f5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97600535747313c5f653faa84b1db5f5.exe
Resource
win10v2004-20231222-en
General
-
Target
97600535747313c5f653faa84b1db5f5
-
Size
712KB
-
MD5
97600535747313c5f653faa84b1db5f5
-
SHA1
628434c27a71a8487c43a13a4eece5cc07900d08
-
SHA256
13d038337256d19996032127430d46323e72745a0989493c441b68d88f4b95b6
-
SHA512
8af6915e6ad81f77968bedc638741b5f5bec16c994b56bee4eaef52c57163e64c0986cb7a15c1f4d14107622c22d4637922dbdb3eed0b435cc89b9b299a3c001
-
SSDEEP
12288:QikA9CmP65v+u995J6L2zmkp3UyIwL/Vz4d+R9vQYMsOf+CN28yzsAwVp0Rnm/FE:QikyCm6J+u9QLMmk1U5i4goswpyAnVGp
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 97600535747313c5f653faa84b1db5f5
Files
-
97600535747313c5f653faa84b1db5f5.exe windows:4 windows x86 arch:x86
376dddc8e33c4e50ce968f2506829425
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord711
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 664KB - Virtual size: 663KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE