�qPhC��)ܿ/��n┻�����Dڟ��]��2fC��\���+Gg`윘�.�]��b ]J��'�h�guQ�O��J�^�����JB�ԼndL]$�M�+�⺭�pL���6d��� �އZ)z)lX#�.5��P6�,ga��oB�v�)���l~s�������� ���$�"Z-aT��<|�G�-�a��|Ղ٨o�ˁC�Aƪ��� �˰�j~ͤ��W����3C�������T����4�Ψ"�R+���.ʐfglh�$>�1籵Sص��2��غOߛ,�?��c��7^"/Y�rV��R�p�g�KV/�f�� �m��.�W Xm ��\Ŭ���5���A{/����w�p�z���{uI����]�>���p�s����x=3��s��*�q�s����s\�R�N��c��s���@����v�j��%S����v�����t��j��E�^�G��딲g�~i�[F�:�؆L#����>b����!�ܣD�".1�\]<�]nO�W؝x8�L���ׅJ!QS�ˤ�jȕ�3�"���e�zD�j,q %6��#|�F%LheJ|i�&�� ��\\�;~E���8������8���}\��8Y��k�;�����}�� ������"-�3���p�D#������/�2[��s�g���dk�+X�A��~Uf�����V&�� �ޅ�'��·��f�y4.5��E�_�i��J��Mroܓg�ٻIK��ːb�߃6��J6{�B����I�z[�J9TL�%n�r�]���*�u��&�w�DW��Ҁ�I;��id�*�.��M��/&Z�����Nt��/���RѶ��8�k�gMC���y#'�a`C*��^�~"͢�,�p�X@p=z�v�g��V���{�'n��o��`o���뫑���#�217�_�bڨ��o�x����ɘ��&.y4�ȃ����8�������'!���4�=� �f�BY�����Ti'A� �/䖜l�\3� ĒF5 Msc�,CوT�a˫�z�z�2A )?�3i ��,������@\��94���B9����k�/�VH�:FJ�GX�b �V���n���9�H.R�y� )��i�e������Ksj��^d�&AR�;���u�X�#C=��;�W��?ˁ8�[����e�j8% ����E�(�C�ǰ�K�ƀ��Blz�,��>�o��UB��}���寻:��;ڵE4ܥ9%�1�����á2ֿ�2�?�g����)�����Z~�^�|̢���D���;{D�s&��}sB���M�ʉ���=پ�TL��^��#aZ��e�������-d���@�$���e�t��!�����2l�5�[�r�|]Ҵ�fT��å&ߟb]ΨWr�"��}�[�z�Xο �&��Y.�N[F�*lcuJ�q��$��v��W>9��O�i.P0)8$���aJ!N�����د�q��Z�B�b� �V���#,���:�����tD��(6Xx>�Ӳua���� �B���;��`OMj��i�C�8�41�gF�S��]E���dږ�O�i@l&H6��@<�7p��8ﲯr���o�㞾����Jm(0i_s��5��8��`�=���6�t x��.��%�.,�Wr_J8R.�C��D���OR��%p7)���as/��%w�@��2t�x��G���w�����%�*K�������,�>�*v*`��������Q�-N��kKַKv쥷���"f?f���#<_�f�1g�2A�ƥ����)����n���i��q�4ݬ�L�e���t��m���4������8�q�8l�٧�m���D��:�M~٧�HO�hHC���'z�7o���ѯ��Q`�~����،�^���q�D+Z3r��l�8��#���L�g�i1f���I��1,����hȌ�ٛTߜsK�hB3� �k��R�Gi"�vF,���"�- ��Ң2(��G.-�YWEP�ql����n�������SҬ�K�j|�?�Y��;Wݜ� H3��G-��#��d���@��ˤ������ NKc�H��)���Ă�Sx�� 9%��T`���e$#��PZܡ����P?���*�LI�{Q�F�'"��6����ۜһ�T�HS�l�bPˮ�������ӡ��h��^="X��0�/!���p��4��:�!��d�V?��Ï�K��ビ��y�G^vx �NY\��Y����F�U��[G�]3P��m�K5$1G�B�[��(M��CRErj�Iְ��{���0�tҕ #���}�����g&f�_ca�U�ڵ�ݷVg��$Ar�p�2q�:W���t�L���:�������r��s?̛�1�+c���bɈ������'��S��ιZ=N��\t���TnXP������ym�I'��?OH�3�@�R�����)ʶ6BLΝv�Ą�Y;�Z��n�WȰ�RR�VD!17_����Vſ 9nk�t�˞]�J�_��|��P���n��'�vMnk��jnx~���Aae'�g��Գ]얳왼����kf=�r���B���_����}�L����&l�1vz�rm�ە���V�OS5�\$���ˤ��a����.��m���A�R��!TRL�1����!^�%a���7a��e�ѭK+��MK��cVNԗ���G���B��7dd���vG��^b�1�N�����C��D��"r6ظ���WQ��D!�,��f0=��ȬN����L0Ғu�}�X�ӛ-^`1���;�6�/v���_m�ϣ���{2�����:����װ�i%��~-bWc�t ���3����MZ��`X�G��dzS|7����5���>�I�B�[�:��\�����Ś4oS�G��]@�Y��t��i�9竻��� � ��'����ܨ&D����B.ƃ<��'�7�X(�pLF6�*�-q�1z�TۭF�K��C����ݰ2$�$���@HA�J��ׇ�������/)�=b����W &��Ǫ+���G�Wr�r-��?f� �X)�'s�Vsy:^��xBa��O�Ӂ����Q
Behavioral task
behavioral1
Sample
4b659140cd5b2ee2e59c69d3c0d52852b50593e05300235894e6a5327d76db31.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4b659140cd5b2ee2e59c69d3c0d52852b50593e05300235894e6a5327d76db31.exe
Resource
win10v2004-20231215-en
General
-
Target
4b659140cd5b2ee2e59c69d3c0d52852b50593e05300235894e6a5327d76db31.exe
-
Size
11.6MB
-
MD5
b96826254785026338d3456a663aeeec
-
SHA1
06464049933a03dbedf8a662fcdc2650e9629061
-
SHA256
4b659140cd5b2ee2e59c69d3c0d52852b50593e05300235894e6a5327d76db31
-
SHA512
6b9323862e3777448b0a8454e959223d5e46bf4821c4e6abebe0ffbbbc8d8e8b2e827e7541f0602c644b7867394986e54f36037a01c329cf3106ace038ccc5ad
-
SSDEEP
196608:wJ1pdSZVnwyGZ+eCDfYjPq0Nz2JZ+vGn1zxfO+5/qySyxOrLM0Ok94kw4p7:+daVnwdMegYq0NEZPnZ5/FwR+k
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b659140cd5b2ee2e59c69d3c0d52852b50593e05300235894e6a5327d76db31.exe
Files
-
4b659140cd5b2ee2e59c69d3c0d52852b50593e05300235894e6a5327d76db31.exe.exe windows:5 windows x86 arch:x86
e6d4a6d3616652b6829e4d43a79b5141
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiOutUnprepareHeader
ws2_32
accept
rasapi32
RasHangUpA
kernel32
GetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
InflateRect
gdi32
CreatePalette
winspool.drv
OpenPrinterA
advapi32
RegCreateKeyA
shell32
DragQueryFileA
ole32
CLSIDFromString
oleaut32
RegisterTypeLi
comctl32
ImageList_DragLeave
wldap32
ord29
wininet
HttpQueryInfoA
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 772KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 318KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 11.6MB - Virtual size: 11.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ