�X�Pi9m��缨n(��ͣU�;��kwB� W��c�CvI[#��M�xg��������Mm�J ��<x�P���������uܕ( ~D^`xe�q%��4�H��m�A(Q����wW��^{���' 1�`i���)�Hg֠�`5H;�`��>̔�yr;�硹}���:c^j�B#� ee�D~Ū=9�%���w���>k�`��kEsb(�������'��FX{%� E�xSu�pa��Z�[x���� ����n�P�� 8���1�!UX�d*��?ۑ�����9�q�>���ۘ`hn���Z�ܦk��k���l�R���?x�w~��^/[=��}/������0vV5_���_m˄M�M�o��X�������g�U���M����pvҙC���n���Y<͓u �u��E}Jʨ��5�X4�2��5�X8~4��6���R�s�������T�&��#���#*�������]��;ޮ����ߞ�PU��M���[ 1k��յ6�������4s�s� ��)����?ˆ}���$�R*�v���W�E('ٹ���˖��v�<�մ�u+��&�'|�2-Ô���+,�M������S���;y��k,��Ύ=��1�]�T�ދ_��!��N�r:]�K��ۃiyT����xW���4Qɢ� ������G��%aY��y'v~����Ss)�ηr3��JRlu�څ��.�#���� �9U@y���G.��7������M<&���2K��{��g�}���� �o�:�ۋ&��b�{]�CI:7�H���Fi�<�J!m-��瞀L�V�u$�����gL]��4U�h1�U�_�e�m�1�����j�?�\4x�N��e�0���{�uc�����{OJ3���Tw[���3����R1�V � !� I@{�<U�k0��2�T���y�ZAf��rv�gtDfhv����oU��`xK���)#�J�PYY�Ha-���i=�i/����U�ʝ���9�Y�K0�P(�*���9���-a��N_��TB[!���!����N�aa��W��FT�d8�Ui�U�0ETe�(o^+��7��&�n�@}�MM!�b�\[L*� |��8s��{B����Z�33�"<S������K�D�ח��@ʨ�^U�51�O �vT1z�x, ()�n�(?��'�ZN빿1}H����&"[p�Ћ�5}&J���'�����&��rX�����msDc�<{�XW��+@Z]�eoJ�/���`������?ޤRWT�w�WXs���'8����j�[�"�Y���Qx�L3��DHQt;C\F���i?x ����uo�Hub5\�5�ai���"��SQ4��GGܧ\�V�~��T`1gȺu��g2��;0�%����#�ˑՠ���(��LK2��$�a���e���uڀ� *x2I��b��`榚��((%3�ޙ�f������"�7*BgZ�'~\���AKDg8�b��8Oǩ�R-xa�T��C�w����Ƭ��%�� !"*����C_�!~�A���ĝ{ƧƳ�884+@a��ڟ�����a�ǗC�@ź��*xJ���OaAg�X@g���S��9C�"��ہ���W6߅�gM��K���b,3Ϡ�CI���"�=�� �#��(H3Yt��5m4�d�a��a�{�#���1?j���Hr��9r�y�n3��M�\��0��%���D�x���zL�e�YMz ���}�n~0�������l�2�����Sk=�!����?1���#��?~�C�F{w ������f�Ň�-��ݥ����U�'�*\WO���Q���Vni����ͩ���^�/gWR�o`�ಷ���삶����B�ʾ���$� �@G�!x��C�>�}00߱Wj�����ξ�1v����0��~�]�i/��-'��U�}w���RF^Ǘ���y�诀Q˙f�p�sE�>��0G.w��|#E0}��~_I"����@Rg�N��}�2"V�q��)�^�O���� �L)"�8A�kv�:n�Ĺ�j���"d��Cr���̓���ڎ�1�_�T�bj�FdW$L�u��y�%�<�\ۜ?� ʀ��� ��P+�TݕT#b�|�_�S�M�.�� ��&�Mء���VoL*?ZsY��+��v��^�ni ��^�{KLa8� Z'�r-l�{Ud�ei�By$U� ��ח���U��2���ʒD���eO��l?�Ja�_>�^*������S�0m ��Y�r��5.l����5\3�b;|�1!Xoa�N�Lq��<�@@#i���z N~8�:�D%���B�P�j�n���EF�mv��.�4Ur����Y�Q@��@��QGJ�O����$9�L=�!Tx���_�T�i�R�Z:ҵ{�X�MMtW@�+�p1YV���"�fħ1�w����o7�����"�����s�G�0�UA�6L��k��6Mg^>�[�#uF����S�;I�y��9����� ��3Ѳa�ؠ��u�� �P�>��۰ҝQ��r �9u���S��N�2[*2��W�fH`}��h���|�t���^�*E���M�#������3�n���%~�' c6{�B#!��B�����w��������)�N���:�{�ۿ�B�7���*o�G&Ic������h��s�XxO��%��ؘ�{�v��$�S�ݼ����LplEߛ�W���k�k�ƙ�J��f0��=���ję�e��f�5e뫞g�<�zu�;��3�������u�r-2݀b�N,�D� �1\���RL���!Z-0��h�&V�Nѽ�̯*�3�9��W�BRf%�Xb�+!P^m�� ve@��G�=��p>���Ć�HJb�]��Ya�Y�rٱ-/f�aT�v��u=�����`�ű$�5�.�ޣ�5Q-<x�t�����s�.�VObU$Nl�r��5Hm���TH1�O8J��]r�K_X-55֢�T��|`��I�n�#g��'7�J��P��_���ݼ��I��ʽ@P)��.0�<�����BͶ���gw_�u �ӻ�\~�m�oL�6Q����A%s��|��.[�_�<@W�Y� ux[��u*�
Behavioral task
behavioral1
Sample
99dba6a0e9b0eaa5133aa84ab2fc0d63.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
99dba6a0e9b0eaa5133aa84ab2fc0d63.exe
Resource
win10v2004-20231215-en
General
-
Target
99dba6a0e9b0eaa5133aa84ab2fc0d63
-
Size
1019KB
-
MD5
99dba6a0e9b0eaa5133aa84ab2fc0d63
-
SHA1
5db8f1bf68b6d6dba3844037512ec5b5f8fe0ca2
-
SHA256
f8c0d847fd7ae021a1b5ce009de1aaa84b0ae45e1e82bedc3aa7c3e14af500e1
-
SHA512
eebac22367d68dd1a0bb14a4084ac3d0b7ca637629b2b8d29e71968067d7d383db3db2c034cd938141b2f5e80a43d0e72327da3043048fef4cd139e82e94cccd
-
SSDEEP
24576:pWp1JfHnAuJzjajpLhAe4EeUJjApPyzk+1qxx4Wb9:pMnAjbV4rMjuKzRqxx4
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99dba6a0e9b0eaa5133aa84ab2fc0d63
Files
-
99dba6a0e9b0eaa5133aa84ab2fc0d63.exe windows:5 windows x86 arch:x86
3abfc1b018807c6f6c9b0848ac9a0e88
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
IsProcessorFeaturePresent
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
IsIconic
gdi32
LineTo
comdlg32
GetOpenFileNameA
ole32
CLSIDFromProgID
msvcr90
_invoke_watson
ws2_32
connect
riched20
ord4
comctl32
_TrackMouseEvent
Exports
Exports
Sections
.text Size: - Virtual size: 170KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 26KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: - Virtual size: 782KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp3 Size: 964KB - Virtual size: 963KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ