r:�3} �n`��?ߵ+��B{�elq�Y���Z�k������ �����;x�{?�!I���@�E���"4����� �i@���S��@�Ĭ�����}ߜ^t7ϟ#���O8���\��:I5�і 3��O�����У1��+Rue�Ss�̲FQk���n�.^�*��94��Cx ���(����jV ��+g[BΨsa`! c�ovm�j�z4�������4��dZ-������5�����cX�_��U鷰_�S�Dk��f��B�S����zhM���n����<Y�c�ס6ˋX�S�DE�U(�,�K~�qm�,�iY�E���ؓ&�X��ѯ�����m�1_�LR)�����E�/|u�x���m�v����ҩ��dk��g ��_��I��H��Pq7� ������~�o��R�l�����7��&���L��q�OT���hX��/]H���c�~4ѻg)�p^@f��jyu�r�f�YoKP^��Z�~�V��� /�@�4�� ��Q�K@p��V�^��#�n��0��u�M���s�����9pT�+#�HF�=w���� $`�X�<&�v�,��ҍo^ /��z�ڣv��S�a��-� h�́�����������TC��"�3���������T4���� K����@92s?'�6�X����a'PT����v�op�y}�FZǍ%ջ����!�;/��̈ ߯���3�������B)�&"�[@ѷV������$5��������j����P\����Ǒ���'��?<� '�ݘ V� ��p��_*ݯ�1e��ϳy��php��\6��%��z�+<a�ێ�8yz��:S�w���K����v��@�xfv��jKY �%nG�.s{�^ݧa����� 0��"k�+�Pˡ�:����9gPp��;5�#-; ���ݕ:V���r EQM���3����}F���7�glLCd���DL��wx|#��sR����UD=�¡2��*���1����4�!5f�(\|�q���m}5������n��" Fj2&<����$���p�r2�3��m�w1rL�7�a��`;���r`p���Gc�N����> �^u) Ji�:�(9 �없?y���Q^�Ì������,g2:���k[�����Gy�����::�d�3�֩v��R�4��Go�nz�%/��N������7�a$�����QF�F5 ��0Ŧ@c��C_�&�Ə���텂5��NG�\�1��X^Y��;TP�?>�8�?]�M|C�䦢Fx��5��)�; ��A5���z�I�Ex�)��ZI�z>��Ğ����V )h���2&�Q��<�O<�5��!� M ��ŵ3�-h�gƓ"�^���Zږ���61�܌ּ[��16�g@�j� �rpiY�1�C�#�j�S;�j�n苵݂(�BC8�TM*��~�{o�ϩ�g�U�ScПS/� u�"��(�����pu������-074�����P����m�eNvֶ�a7h�o)@m��� ��]g��D@�>Y���B�k�%��4��n^5cj�9p\F���e��6sĥvp "��J�"��ۤE�$�w1W������b{(�M���R.��x J'+VJ������~!�Aǃ�����!C�WZ����:���&�35�wMB%߁�� ��������^���Eܻ[��� ��o�j�Ә�Ԭ��i�~�,�5}'�@���Ӿu'�l��U��q���mwPG��3 �@��4�C�����0k4��7�!�<:J�H���*�i*��*J��H|#�}Z�����7VHHWB�:r_�m0��:s�~�㛨#�=����k>Pʩ�S��"&�����LJR�6�e �O�eڋ�D�V��?i���q�!9�\N`�1���s6\���Z���,S�"y���z,���,s���?'(�������T� ���=����h�c�p�#lB��B� ���T��I�r��xqf3H�t0%:}5���. ��� "�X�2G�P�3ׇ�D;�@3�X���]+��y�v�^F�n��^���R8�xվCi�@k���_�~�����Q���-pW�˹S�»�:#��i�?�����Z��o!�t�S�!iBZ��p���͘?�f����Z���a�E-L�\ ��%4v���� �C(���ĵ�2;���gP�%�A��ˏr�w;�����w0�;;W�2��8�m`-����D��~ ߊ/ڊ܁���Mrb�ގ�.s�$�-��j*m�[?�3{��.���T�������/�6�P���o�#f[��VN��D|��"�������_{O��3�a�����lPW�J�*�d|-Lc5��[��F��}}�]�,�;�"���¼g�����)S��3���n�v�+T��<p�2�Nf%M�rC��BM���K��p�}��n���j/d ��1�?�!@u� �`ڀ�F�0b/&���a�8䮦}%�kS��U�l�9�����*��&���?Ʉ!�QD_߲��n��k�u0���O��Ӛ��'Vh�$QZb]N^����RX�:5p��h:�п7�5�f:]��F4��J�I<t�5��]�����Zr���d�;�j�h��,��ظ�eBǛX�Gƴ�����i/eSJ�[.������F㎦͕#���� $��7���T��:NCT��N����vW_��~3e�K�ו:� �آ�q�E\v`�0�4�����X]tGH~Z��%I%���m�٦+&�(��0D�cH�lw�]��$������=z+Q�бj}u��QA��;ߓD�����U !zR�o�����:�/\}/h9q��������3���H&=x�1��:���[�Gc��1<ܢ�Ͼrj�L(dBF���~y_��!�j\謑uq�q�/&����~� A�I�\ÿ�"�,��T��ɗ?%��&}r�����+���U �-!͡�f��b吏�Ɵ[����;A��g����i�_8 �f,ҝj�p�؏%A\.�����g�\��G�"���>��c~�Xa <�����<m(���db4�rԉ�"�W�]�i]�I�P6cv�D{4H�CP
Behavioral task
behavioral1
Sample
9ab8b5f7d63a055392773cd016908105.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9ab8b5f7d63a055392773cd016908105.exe
Resource
win10v2004-20231215-en
General
-
Target
9ab8b5f7d63a055392773cd016908105
-
Size
1.1MB
-
MD5
9ab8b5f7d63a055392773cd016908105
-
SHA1
b859ffd73dfd303140f4d7bf11b255529cf25cdc
-
SHA256
a16a1582f16d44057bf07456249e25547c6ceca60dfab0798682a2a42c194e4d
-
SHA512
f04804697bc1420e635189fe967f9194cfeebb97335c1ec9d726a8ca377dfaacb9059969510771529b6553b46de90a4b5f822bd112e639c3517493cd91ab3a61
-
SSDEEP
24576:+WLfP1rRjONKyZlcqyQz7mcEOe9S9JBlHzPGN:blRjOIyHyy7mQEoBlj
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9ab8b5f7d63a055392773cd016908105
Files
-
9ab8b5f7d63a055392773cd016908105.exe windows:4 windows x86 arch:x86
c1b1629c7424c59680b640459bd6228c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetWindowPlacement
gdi32
CreateEllipticRgn
winmm
midiStreamRestart
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
LoadTypeLi
comctl32
ord17
ws2_32
getpeername
comdlg32
GetSaveFileNameA
Exports
Exports
Sections
.text Size: - Virtual size: 449KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 340KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE