h*�T�.~���k�"e�i��iB�H���S����ԝ�WZxT��iY�Xf�1$���J(�y7@��9[���8��粇���s��=�TpNK�1�J��ל����@���f�jc�MJ�2���/z���-��>R-�,UHY} Tj�X8�+��;�˃�Z >[�1�{�K��U����P>�I����-�*VX\aXPF��rJ&�*�叙{�|K�1�m�s��9F2}]����Cї�p*N;� |��By���"J�V���V��5��U��+v7� �ad����t�� ��P�^5�a>&^� q��������O�%��$lur��;7�2�g#��pH���#'�ӆD��${3�O�y�Ĥ �U�P��U`������!rUxx���Ά��L��8�����[�e̠��AkX��(�>��2���J�֢��G Tp���d�cx����X��P��O�O��>� �l���7���}�t���J \�`^�~Ȕ����ũ�| �f�+�ۂ ����:X� �R2�fB���oCЋq���# �p����W. f�c���`a�} ,�Em���3� f���<'��]4.�r�,䂟�8N��y|I� ��$T���m�O0k���@�9}�k�*��9�7�튃z�����*��H���,�wi.2Ȩ's��ML2��>9: ���5ZE)>��âc�E�Rg� 0�7)��5����"Ղ���Wh� ͻ����ȐӺ+ti�@�RITg�0�rt5pN w�c9���F��хU��7���Y��Z+��M�F�pE�����4�,�_b��$�R��G`��b�(s��4~ɼ�0�o��.\�d����^x*�HEKu�q��h�ZO�Jse��k\�~c�f~ǘ���/f����!u�@�����%�ۯ:�-�2< �z�y7�Z��#U�P�*롸�ʥ`�����rӭ���!��oS��*���8��AZř�����rM�ߚʢ� �l�7��e�5q�L��Q�c5�WIm���D�*#r�t3�9�L.�Qx<0 ��Z�Fpӆ��::6N���CD��īah93z_��H��["&c&��F���Oxw��n�TeI�y�ށcg7�U����"�����i2%5�i|�bCg�+��i ��~'&y��e�v}0�{~%�wKT��NnH�E`c�t��" f�^Y����XP��r��0��w-��>�Lc뵔P��!^�*m�Vր�������D23����PT�z�gJƂ���U�6ѦNK�2�8���i����� O�_�����8<��I�N�P���T5��'��SQ\�gr�.��Spl���Ĺɠ#��zJ��H�?RP��?�wt#-yܠö$���;U}" ^=PYK8�+�J��QPA�z�O�N����|`�ޙJ���,�CT���~�1T�V�� E�:c�z;]���;`�0�[��9V=�$t�·?�gi S�x�np��b�� )Ѕw�N͟�)�6�2>~��R9�n���+�F�D�IM�5�R��% \q���{�[aH_Qъ�xV5��$$�C���#���N���1E����͍ư��N�:) vZ����qiԽV��X!R\Ka��ZJ���F�ѓ8���d�Vӥ�� z�t�����H���TO����� �8U�����$U��dr�k!w���R�Ϻ��oس�uh3d��8R�)�m � ��o'f����S�'��,4D�M���L�,G����A=��O�v�����-�W(0%�{���rnu�U}7�`t�Y74��f��!�~��y�WEm���~�^�����(Eʏ;��mW쐖��4 �|�R�J�wv���ye��������I��e��urU�ue��F#�&�+�ĕ�W9#�:����+:P��}���E���X�3\KȃH��E�S�B����ʚ�3�"��G��7��_��`�H�]<�%| Q�T;���^p�� �c!��a����" ���/US����'E#��q ���D����O��d� ��Z�%���Lƴ)����n���C��mNƾ�v���K]I_�DI6�����"�1��[0���ڭ~A*�`K$���)���5D�t��2�%(��V8}ߓ�-�<b5'-��� XM�^������7\����,��Ӷ��mT�/�!0T;��i'����)�PZ1����ڍ�����c�� ���c �'g���2y�_p^ ���Ϧ?���Rtܓ�����z�o�Zϟ��}���ޝ����yS�輸I�ỉx��l$j��ŝ��] �#c��@����X�$�,�m�j� �'� ��L15��Ω�N&�F]��o�ioE��vLG�^1%��8��TK4Qg= G��1��Kț<�;��Q�+��,��bg钏OW�a�0�酲m��e:���l�x��@x�e����v/�����Md�_UĦk#W���,�gjT4@��l�CH8����=��BsboC��,dKV�e��;�A��U&R��\P|��bh]�����-�R�t�֮z;3�"�[�����Y`��~�qpQ���"��an��.��w%��;7U���]�m��_Q��'pqu��u���F��4��}�h6�U]!�"�,�T*)li��/!�♀�mX[�:��$Y���i�$z�Ր��w:�[@ jTrm-]���QԜ���T��ӧ�17�Sr%pe�UV�X��b�B�S�H,!�%�3C�"�qCM�2��F�]q�!qՇ�u���A�.E8ʔ���#r��X7�2~�x����ٗ�&z�\�e_ئ��`^-Lj٨E�VM�rDKc�v/�C�$o�qt�h�����',��2OD�sѼ ��r�-�3�L�f����X�ȸ�3� �U'��F�K�����+@�L�=��k����]���q+w���2�XP���*]Lɍd�-�gy�WWRD�0�o :�� �8�wb Y���D�l�_�$�-4�D��UC"BKݟ��H��ՙC�e=LjO6��J��ho� Baⴶ)��x'?�������|!�|ʠ�]�.v��̛�6)B�!
Behavioral task
behavioral1
Sample
2f577f6ade2c05ffe93cb7b14e4a53f6b0fb0082c348f1f462e96881e6ae19b2.exe
Resource
win7-20240221-en
General
-
Target
2f577f6ade2c05ffe93cb7b14e4a53f6b0fb0082c348f1f462e96881e6ae19b2
-
Size
12.8MB
-
MD5
a5994bfd3048d48de6534d70bcf1fab7
-
SHA1
1bfd11447dc42805d26fff1c16bb2ec96ec29396
-
SHA256
2f577f6ade2c05ffe93cb7b14e4a53f6b0fb0082c348f1f462e96881e6ae19b2
-
SHA512
4b74e8388f74f7121b23dc40710a2af9ec07aecb65858285dbd8b6e81e7d29692560bb5f247b3beea89c798803ef039314eef71d3300b401c066c20e8e4762d8
-
SSDEEP
196608:OiBMUwFG2XRlPLe7hcGpxbkgXWlpvXX/h0+zMLZGq1wcJlK7Ylrm3tGq7HgZipp1:ViXlPLQhDppIpXaljJlK7YlyYZyp
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f577f6ade2c05ffe93cb7b14e4a53f6b0fb0082c348f1f462e96881e6ae19b2
Files
-
2f577f6ade2c05ffe93cb7b14e4a53f6b0fb0082c348f1f462e96881e6ae19b2.exe windows:5 windows x86 arch:x86
9f6881bfba0f46290564a7bfbf369f4c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamProperty
ws2_32
accept
kernel32
GetVersion
GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MapWindowPoints
CharUpperBuffW
gdi32
RoundRect
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegQueryValueA
shell32
Shell_NotifyIconA
ole32
OleInitialize
oleaut32
UnRegisterTypeLi
comctl32
ord17
Exports
Exports
Sections
.text Size: - Virtual size: 667KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 12.8MB - Virtual size: 12.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ