�2�^9��b�*��g; F�Z]n��Mh��?�7�`�P�nBA~&��Nēo�'����+g܅%i���u$e�i�G>�d�%����ԕ3���s�@88�W�[tī��5�a7�����;3��������VO�$�� ���i��$'���屩�Q����N������s�>s������1�/`R� �ԋڨfpdv6��l�O����y������I��8ZL���N ���aY7%A�2�X����g`�,6�%�]U!��;�� /�r.tM�S ���]tq �{D�hn7o���W#����\��Ɏ9��8<L��~0�E���_��!�������}aSEL����A[�e�g2A�L�(��*SpA�g�;��� "y��|$��������V#\^p|�p��I�O8�qv.C�݀�Yy�Y��85�@O'$~�~3P�?_ܔ��e#S��F"�-��Ķ�ηD�d|�!���ip�!�Q��R�����XT%lx���TZ��TF2�9졍N�L��Y3y��k������q�a�_ �;�k�P�g�F����}�囆��z+�d!?��cz5 6Xs���Q˻ ��S�>���\�&�{��T$���"�BF z�;:G��M�/�DG�QP�Թ0� �"��,�9+`���x����_��Ĺ��u���� k��ߒ�s@�r���E@3���������sOG�P�H��[��g�9T��[���V?���Y��YJ&(F�(w���}���H��m@�N*�#?I�*5��x�S���c�f2ǧQ��b^5����Os�2q��A�����_2��E�f�t�I�M\�p��/!~y�� zH���/c��EV�����'�V/��L��ن����uC[5#�bM%��d�9Z����]��%&:�7���~����`aNsUM7DA$ca���B��Q}�����;��ů�#�$T[07/.g�A�+(�F}:F {h;�[�w���r�f��[e������� PI��b���l)4߲�f���I�[��ᮠ~M�jrS -+��J��v��lrQ�0Hy��o�u,�?���P]�9����"�8@�E �7��_po!�}�%p�PsC/��������B���U�g���Cq�Z�i���&S������+Tm��d�U�on�����*I�7�q�f1ދ���i�zJ�eYN���lE��סRsM�j���+���t��p����/�%�#:/�k'\%��a�(`�A����O�I����g#��G�b��7pq^I��`�=�G��d;)eP����ἆ���@I������v�?��:�h��v =Fۢ�=Q�3 ���sE<����wE�����Aog{� hț5����&UB��lh���BM�4�\ ې3�ӱ.�������Mg�)����];ӆ�Wl��T��p������ 빧r/b��iNy��˝*��K邦�����Ըňr}d�1qˤ�j���A��"~�+c�y�X��Jt��{M��0�3�pyEU<)���0[a�fX�>&�!�2�hz��ԯ��Ġ1���d�fM�X�C�y��we�i@NJ.Kq���b���8�R����]��9�3S[Ȩ!�* ��*Q4��u�d�+�ʏ[$��#� w����7>�+2B������QP:zk�5�,ӴA*&�l�n�q��8��;摰�Z��+=Ԗw��~������mcRo���&���giF�aG���c��JQ�=m۔-�� p@�*�����bҪ��A���0�cV���ج�3�����j�)�.ØDQ CZ��<%��gɣ�|ZWf�Ȃ'�_��y���v*�>�fu|hN�P%U�$����%m�K'NU� 7�ePK�c���M��%vdX�������Qp<�0攎q�RI�/W�*�E�*f�fO�\��2?j��+@��MB�7�fR����pM7�\�tAoFv?��5u�6 �O+��&� L�������������jr���C�.��|����n��A ���&s/���9Ҍ>�C�c�����T�*(�G4�k�i�{�����z�M'w�k���Grf}���킀��q�52��^F[���j9I*�n�zUZ֡ ї>� ��[����س����;z7�����Iԛ�K��zC\��S!����6G]���t��4�/m�G�u�t�\�U��� 5�D���>u���`܅���&Bؘ�D��PI���˺W�z��{O;S�"k����>�ߠ��E�4�&f�j\$�������<�h�Ԡ�n�VCJ՞�S=�L� @`9������.;0�V?:)�u�A��I���; G"2M���#����?�o]8�����7(6�*Zh�莟{�FR' !a\��<��W���zV����GuJ�.�ZH?� �^��:C�u|�`M�d%_Borfߨ �i���H�6q|���U7�YaE������e���pZ�7�<���A���n���{9�B��"���n��c$�s�� �N ����N�� =c�d��(��,&m���� I�އg�|pɿ���"��7@�'�;���^&��C,V�@��Ʃ�#��iY�TÂ���{{�L�!Q��yɄWus�aU͝�j�I"��x$�(��d(��~�E ��0+c����{=�Gm�66�4� �y�%����bMg�[Ļ�9!e�bY���"!�e[�C��'��Ɯ����ϳ~�,��Q�>(��/����c�M&���u�����u|�a�z�G�z�G����A���q�\� �D��w(9/����X-m,�T�˥�$tWhA�i�q\E=�ܔ������=Q���]$J���7ő}�W_��Fh�^�1���b�����6{v̜qu2�,/]����g�N����>+|�'n�Y$�e�Yy��K�^ ]�Z/�ɚ�wE-�"�ū�ո�T7ȣ�߆L�h0ng���~Z�7Q��~,b凰̜J��e>��1���o,ة��=�'i*)d�e���m�:�V"ȾU!�&� j�jE���-H���+��!�
Behavioral task
behavioral1
Sample
ad26ce46cf6df4904daea0baecff36cd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ad26ce46cf6df4904daea0baecff36cd.exe
Resource
win10v2004-20240226-en
General
-
Target
ad26ce46cf6df4904daea0baecff36cd
-
Size
704KB
-
MD5
ad26ce46cf6df4904daea0baecff36cd
-
SHA1
b110e7b14b2cab7623caf2559d099f614a180af7
-
SHA256
bc38ec7b3239c766812c498843e5068f93df5f1ae3c32629e1f4c7b07cd1f721
-
SHA512
c8a8d101462edfca355160ddf2f9df7b7036d3e192f69f091545049385d0cf4636883a3c7e0c55033df7dc37cc8e5019b67883cd1504f47c4a43eccc7e1adc5f
-
SSDEEP
12288:ZMXruAtniiB9L+zSMAXzin+6EBrmSJWmmReyHQY6FUN0eB14WsSye:I6uD9L+eNjw5HW9uNwY6FAsSN
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad26ce46cf6df4904daea0baecff36cd
Files
-
ad26ce46cf6df4904daea0baecff36cd.exe windows:4 windows x86 arch:x86
e8c1d7c1459ecb5acea3327d6f94f6f0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord717
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 692KB - Virtual size: 691KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE