�0윪r��D{hϘf�t�B�DA�fx߽����*s'���?����p��>�Jc�����u39�i�q�'��W�0��;7�d�P=6C�\[H�Tш��� �-{d=�p�F�����tR��`Q B��_&1�W�b7xZ1�UTw�%�%ENd��;�VqgnD�_���[�~�`��u���%AF��r=�ܭC�� ���9�_D3�G����l����8u��P��(��[g����F�}��ݻ�N��4Q�ӆ�>)Y\�^��2q:��\�����M}��A{��[?x ��h ?�a��D�d)b�S�� Jl��������U��r�j�-Fx�Ϣ��)\//���������4�~�s�9v����3in�x�J��$;':e���V���A�;�D9ԏ�y���� Q����. oHV�S�)�v��A��6Q�*�9�[3�]k8v���U��+zR��1]M�����M|`�i(MBt[�KZ��TS��Ļ\sz�,;��J������'Tşj���� %9�g��z2~���4A��z�y�:B�8�����t�]�1J������F����p�{��a�Iեl�����؎,H��I'���\[�r�&#���zM0Ak�pL{2��W�g"�Fa`�i^Ç��p�wM6A��4?yP3Ly��o �Xi�V�2U�Z���W���W����Y�Mv#��?*!I�T�t����xA�/�dy����S�W�G�`z��<D�a��5�>��X�_$�w����7�ha��֙�2�uJ���w��t��P��s�A%9�G0����qU��<�T{�fD���-�6 ��)O�f���w�bc��Ĝ� ����1��<�m� �P�ot�d�b�� I��^��sI��vMDZ�@�0��$����t�#�W�W��9���t����~���j���a������F-րjT�P5��p�Om���8�/5n{��K�z�=�+h��hO�}��<��R{���Q��s�F�S*�lX-�?�z�������<9�:� b\dG��X�>J��p���b'����I~Z���Eb6(�WJUp>OH�_�n���B�^��K�45r��"��)�ހg�r����c`m`|��a�� �?�~:�t��oH�,�Zj T^���_q���mm������/�x�0���Șd�¦��X�1�����W�s�T���>�\��������d��Y�l���K��]�=���Pq"c��)�٘����� �=��T��`�h8N�ZJ�uNa���AtZmv��E2�BFXd)kg��s�"��&�m�F������S5�y>&�ʓ��N <Jv�V��='�� ��Qr��KR[o�n��y���n[��թ��0{6i#�`Z��9k����=s����L�Ȑ���z��,����xO��z���5^C�yo�6\�${~��zP8 ˝zS�_�Ro���U:�S�K����j��d@4��[@�'�Xa��*q@I�oq%��"�䀶)�6��2}-[F�ftĭ7��|��h7J5�x�D�I<�a�����є�_�h��-{�����Oa�Hև�r�����8-_{�rse�l�tM�) �k0ح�-b�\b-�HBȀ ��yK�f T�+�~߃����'\,��X.,ly�r��9Nʹi��5���բ�]/~J�h�<(���gI��[Y՝�&��t��ԅ-dNā:��d��c�n�s^e����L�C���N�D�������[���d�ɡUK�(nx�?l샊���}��#��h�rA�jȷ=/#�0����o-KC�#ǹ5q�{����7k�9qYP4 ^X��#�;^]q��0��k!�j�ؐ;���$�� 9�@ K}m�f|�7�1Q�3�c �k�.Z9��������;��)nd�F����]A�`X�O���ֱm;�צ�B��Vzo�w�Ӫg�/7çn*hR&�p��3�W����$�~O8胁��U;�����K��I��'ݼ���C�#��w=0r%m��դv���A�(�P<�����!':�y��!+�٬�s ����yX=V:t�����WNO@��czWx���v��ϱ������������F6-�b��+�&�S@|{�O�����`�I����\�(�������N� �5B�Ky`]�oa/v� j���D� ���� ���Q�,aG����1WQ<]�;f��[O�����dʖ�Pbu�,ۜX�i��U���a��Bz��+PQ�A�}O���G �Z 0�ĝ�\�;cDVw�Hd�c��-B�mX�D��K_5���]�U���c�bi˞F���p��G��]�C��}�y9t�(,���:��)Rr�WG>Ԛm�w�T���kxz�0Y���P �q��_�"YO�E�%���3Cw�~�����&.��F}S���xY;�, <2�]�R]���SP�}�B��D�q�Q�U��|iU�t9��[& �]:~#µ�-Ǜ����BԴ�{��#�p�EGH�*Tu�J"ע,�����ϣ�J���������^3=h�������#B����i�ʍ��`.��U `��W�(����ժ��|�Pk�wG� �Է�`0ZoP�gAV͎����daA��#@Z.���ܲ�0�J�Ԑ�����x:��fU�$�����A��>�$�%$S��μY�"\������'X{�#�nU�V�Rk`�i��W�P=o/�RWSF��6�^G�-��S�#[�J�iT{S��I<��D����S�LQ7��X�����(y̎^�|Z�p��oe���"Zw��}.b�CL-p2����@G�v�be2��ċH��_o�B�2�J���'-��/��FR����� )���Y�oO��Gu�����P�YQE��2-b\Q�7qq��4�c�}��U�Saz7�PQ��DC�v%���>L�4㩂�w�ߜ|�/0l>�~o�3 <ں��Qx��ǵ9���E���29>f�x�8:����~��C������n��5�R6�-ƓO<�vf������1���@"���m����W1��l�Q�.W_�g���
Behavioral task
behavioral1
Sample
978e0712a1548072f3ad590df59c5857.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
978e0712a1548072f3ad590df59c5857.exe
Resource
win10v2004-20231215-en
General
-
Target
978e0712a1548072f3ad590df59c5857
-
Size
732KB
-
MD5
978e0712a1548072f3ad590df59c5857
-
SHA1
e7c0aad695ede911ac907b67cc5595bca59bd06c
-
SHA256
bfd4b001e81287ec4e093547f65891339f63a6e7aad8fdfe1d9279145865e54b
-
SHA512
bb0fc5885d161660bf942d8acce808cd12cf5346551b8bc6a8b7f1f9eb598eb4076d10f2c2b5ee47f78b9594db5de54351268e8c4c4dd33e5f03ba58e120c7bb
-
SSDEEP
12288:CycAK4Ao7fuGkTFWcw9f1u5IvuA/jnKlb/Y7pjXjqZpOPz4ksffXDe3zKq:jhN7fudFa9dMI2WjnKlE9jpL4d8zKq
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 978e0712a1548072f3ad590df59c5857
Files
-
978e0712a1548072f3ad590df59c5857.exe windows:4 windows x86 arch:x86
b51e718d5a77835be1fcd4d18564f196
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord516
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 646KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 720KB - Virtual size: 717KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE