$��ԧ ���3gHҘ�2�J��rBKgR��n��r��s��0�o�w1l�Q��@q�XD6�b%����@��e�* iO�v�9L����9y�ē:�W5���S�,�v���?H��gDO����ܗ ������1���&���!_љ��xk���u��o�Wb ڑ���<c���)��!��W� e�c��*$�<a�����p���Y)�{d�X ;��zT�t~��X�SjB��Cr�p�(�$�=��.����r��'���-�6E,�2����/)`�o�g˹g%ӗ�U�;�ȿe�ژ%+.x���F28H���-(�T�*�lp��N����\�o�Q/zH�T4�=D���갾��}xM9 �"�����d�\^��8�IǤήV����vY't��H�~��~�rJj�7��D06��w�U��@h~��<���3�^���a%1���'|�ʋ��3��y��l���! �[X��}>jO{�*�Ǥ{p)CHJ��o8 ^ܷYM��u�@���Ua�Õ����{!��p�H�q��V����������=<�j͗� ����I J�pW X{{!���@=��:&��y"v�0*Rd����ʟd�}�� mȉW���(W�u��p�����M�L���2���t=�^��/�(B���!>���ʲ�$��cU�@"�A�x�?���!�b�ړF]��jdb$���d���u�E眣!��QyiXEx�j�t�2�)8!'���=�4R�1�iԖG����r��֜�F��EE<N��>�MωU�8~��o8)�^?�O<�u�0���Gۅl�²[}jn7h|X/�!$kK�+u���N*�m�g��8oP6��A����.^���)����|�!��0p6�)�[�l�b[�%D�?aV��*�m��}��N�4W~��A7�^��-�̚��>b֠!�M~��6���@ ���k%i�=���A�[�^8���l�XC��:ϓt����i':-j�� ��A ��2�@�u���6��F�W'�c>�%�:�CR=b��1�� �~.z�0���to���u�iX�X� Ba�tϕ���`��R���ۧ�����};{�"���E�FA��.4�=�I:��vY�e�2yC9�~�����-`f�����=hu�%Z�*t�2z�giv����nC��&�b���ge�1-�^b9�I���[��p�X%��=�1�^2!���0�ZU0�s&�R<�&�����W�1s��Q�C��}��� ��ʤ�D�ec>�WrgF��R��ACG��c��s���3>Df��f����;��H蕂^���H����Ux��i�y����z�F� ��ky`��k��7����L�ݩ:� Y�e��il�g�#b���4�|����D�ԑ�龍@gVw�UF��)ZtO�Ȇ=����`6"��Dv���D�� �M�u��=��$��PF(�#�v��7� B�}A�\"��;&��UVe�N"m��5%ax����&ul6֤С�!5B�@2`jp2r%�� ���:�P�?GDZ���mf�Ϸ Ƙ��w[��B`�����0���~�@�|��؈|:`����S�$#�45�@��%��WT��ڱ�Ȱ�p��β*j���i�o��s�j-i�:AĠU�G\�ǖ�������=���E"!�d���>]z��h������ɒ�E��ca���&D����Q��j�5�m�ZC�m�3`�cv�L�S93������$28[���*�A�a%����������:[D�v/(+Du�39Ѫ��8���UgEKU.��b{g�b�GK�w�K|����o�82-�����k���{��-��Y�+u+Sn�o��,����p���l}�"�7H�5-����ID�)�xZb��"��m��h�<��T��XShfP�|�_Ԁ7�D�YoW8;�6�R�ۆ��@���\���C5=*���c�p��(�ا�^��~�9����^䖠�������>��2f�t�>)�+�5�jF�����'����X�zڛ�5������*�Svo�>�ę�P�r�6]�<Y���k�ܔ�,�u�se:d�� bƼ�E��o,^D֣t=+X�U.�������5.u�b|�AN�yv��Y�;�S�]��Z��j?� ��Ç����Χ�^��qY����:�>�~�T�_);;�t�,�Y�w�Ki`�^N���?h���o{m���ɺ��+́,'-�:��3�\��X_ n�7�˺�H�9j�f>ĕrQ�a���:��ˆ��c��x�H�]_L����Qq�ӧ%*���=��"��>�➝_N:��o���Ho���5�E_�֥�I�����Q6�a6���=y��%����<�)���r�R��L0k0I>a�4Uy��jN}�$�h��h�F��&�p��2���+��Ac���[+d��D�)]�6�`�����[��H|�%�V� I�qfH�z���KP �b+d"��~�� DYcQ����_��_���5��Y��ם�J'ȔRŶ��tR-(|'��!o���[�:�^DδNq_�Vvr�-����pʜ/� �����ۙ��<�~�+h�O�@cPwN�T�tT�`��Ra\����I~\�2�U/��f7]�i(�>:���N�Ɔ%m`��ۃ$���v��q�����s���@G���O�o���B$Jm��Pi�nq�JW�2�F�����<v�����cx��Di�!^���a��E��̧�L?�Y������=����Up���R�G,C%�[�(L�����d���hc;��!�U���Pyq�0�v���{�#`���_�~�a��ީĊI5�:�%̰>I���ռ^��q��^�G�$���H��c<�e =v�`p<�s�ڳ;uubR�U�<����j��䎁�*���O�Α��~|����/@O^� �4��J�1aL�Lj ���ݟuu��Q�I����0cV� ^d��!���+N_Tɤ���� (��n�Ng���V�uƗ�s���9����}>]���� �E̢^�--I%L� <����W�����C�ߝ?���Z
Behavioral task
behavioral1
Sample
ec11fa2f7f24f6b42d4e763c64b0e51c177b1fdaccfc1b7d303e0f3b1f7ba31e.exe
Resource
win7-20240221-en
General
-
Target
ec11fa2f7f24f6b42d4e763c64b0e51c177b1fdaccfc1b7d303e0f3b1f7ba31e
-
Size
1.9MB
-
MD5
980183c7e306fe7b4d25d926b6395b41
-
SHA1
ddb6c709c076abbf4a92d2be8c8fec70cf596a7f
-
SHA256
ec11fa2f7f24f6b42d4e763c64b0e51c177b1fdaccfc1b7d303e0f3b1f7ba31e
-
SHA512
bdb24286ff327e81c89b586a8b04158c31f0c0bbd9f6bccd17ae9b9215f80f4aa711267f8b37330e0483a82277b11559144ea5bb9c822092f5c41d79356f2e7e
-
SSDEEP
49152:W3TzS3s7e6zHLlpjg2yPuY8cCUUH+p+kUQxeDti7ktYQtHDpK:w/Di6zHLTjg2yh8OUH6+HQgDtIw5tHDo
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec11fa2f7f24f6b42d4e763c64b0e51c177b1fdaccfc1b7d303e0f3b1f7ba31e
Files
-
ec11fa2f7f24f6b42d4e763c64b0e51c177b1fdaccfc1b7d303e0f3b1f7ba31e.exe windows:5 windows x86 arch:x86
635ce25fc76180512c9606cf82191858
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVersion
GetVersionExA
GetVersionExW
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetNextDlgTabItem
gdi32
SelectObject
winmm
midiStreamProperty
winspool.drv
DocumentPropertiesA
advapi32
CryptCreateHash
shell32
Shell_NotifyIconA
ole32
OleRun
oleaut32
SafeArrayGetUBound
comctl32
ord17
ws2_32
accept
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 580KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 425KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.9MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ