)ٿ��-��A]���!�V�E�*҃loD|>N/1�@0���HY�)8!�.\ �X� "VV%pQI��J~�'<#�?*}�u��������M��_i��qD$�f��O8N�OK���I^q!q�-�1e�Z Z���d��y�0;�SE6gOTJ�~1�����~�G���f~�h�@D&b��d�����&�ߤ�ʡX/���6�ѕgEC����B;!7qv�g���WU�:�DD4���mBSG2�*6&F�˔��3psp7����E���v�ПO���U�N�b�@GOIr�ҿX�C�N�>��}�eC^��!�bw4Hj6�����WZ��Nۂj�6���&��3��c@ْ�+i�`�CF�V:�('��R�{1������'sS��T��+#�����аL�/'��ٍ�4�j���@�P6uބ��zb��=;TB0���j����Z��������H5��jah�Ȼ�I�� �L�Ι�D��o�3qNs�-M����)f���_T���J6J6���Xr�AS���|6�(V�������V�����5�� 6'y$eT����jU�� ���qz��f�r�UO�U� 'C\5u�� �8a!��ȴC�!Z� g������c���2�����^|/N��LZ�����3�z��r^y´�,^n\�C�V��>�_֎\�i�V;���n$�ws�7N���Xcݧ)�U��ٱ�"���y��@�^x����|8���^Y���@�TGݒ �Aiy��_[�G�� ��'B������E�5^�["�l�h%� �~�7�ѫ)C�c=�H�b�#㸁�I��{q���k�R�o�� Dۂ�ܳ���9XZ#p�y�����.�����dV$�6��/ġ��O�,iFGg/A�.�V:�S�tQ�/3x�}k�w꺙E��K����P��� ׇ� ƯC��Be^|�%l�=���B�Uڄ�-��d1o������B���#�Q�U-���z�o������~��t�&?�>5ɮH)���Ry�lJ�XS �5O��dL6yCJ��,�(X�_|#z��^.[���a❩��z�>�V�\�H9q��D�+�ϣ�%�웄�n �����z����.���C�� ����A~$ˌ�.4�� P�|���q�Oi�Y����2`P��:�@�l(`xQ�Src����(w������~����% yd�ֵ�MT��� �Î1��ñ�ƃ����@9�j��;���)_)S���<IC�z�U���i��D�H�o�=��4�9�DCm�Ʀ�]6PAs�sp ����z��>�t�oX$VS�v@TkY�$���y��ۚk�Ƌ������$@'���GԒŇ�ޜ�2����"�/���,}�]��H�6jMur1�P��sOHJ[A+�� ��UA����6wB����JN�R�%�7�������7���Q_���ī�����H��ߒ�}����Q�7]^(�zW��G���9�h��D\J<��3�Xq1�=#��l����F�$t&w�I.Qպ��̪H-�/K�Dr� �$ߡ\�<#=%�<��hf�X�l����2b��H��-�~��Nw�1�'�lL�x(��%t��m�����u��S�^�����ې���T*HF��D�sM�x�u��˨����!3��NF�����W�TXg=X ~u���p�gdd~v�����f�Ҏ�fm���2`����~~�M�<��Y�Y3�v�-7]h f�GG$����bq��Kp����KFH ̹���l���y,j�T�Pq�,&��G~ �`A�R��H�ټўg£i���Vqس�±r�:��a�`:mc]���K���}��E{����[1�n�?���8�{�`��H�$Y��w��@p���Jӈ�Ĩ-�fY����/a�Y��b��Ʒ���ٱ�/n'�Q\o1�b���Ť�o�h�vP-%�.-;#;�H�6!q�9>�I \���)/��e�RN��h��N��7�q^%���L�`�@o�I�?yG�o�p��<i�c)�I�WӲ�p{���E0�n~Z�?Y���Uj�7���{T��˱"��4���3��¹�\��!�%A�Bٽ�9%0�~�P�YַR?�� ���q�������t�N+k4U�w�;a�����Zy,)��� *�R�c �7���U�(�1��U��t\Zi�J�����(��E0��fYx�`�|����^��]N_~�Y�[%;s��CzFB���zӒ|zն�8�J����+�� ��υ��P�%0#�P��ٗ�.��K0ۇ[�$]��8��1Mկ�7=��� 2�:�h���B�˺om�N鑷-���a_�z�Ґ�������?L?{?�Z�Ǵ�h�z�B��am[ʶ6]�%�h=@�'9J���z��'�%���O'�}'iq�z3"�\Ɉ�����:9�CS�-�=?�����)�q������Ǡ��A�F����#(�9�&Ft��w�~`�+%(�d�2��E�.�{~��/�����f�j�xw@�6 �Q�x�u�=��L��b��@t��Edd���@�)4���3F$U�M�s�������@L�w����W���� /v7c X���6��sIkn��J�h���0����cR�����P���>�0l�����gb��_e������k��#��'��3[���U��-*��}�JE�;ƻ����PrM�s8c�_l �\�����H�mI����li�mm����V���d��������eh�t���`��1!:�����(���(ecL�';Ӷ�UX��+� � �F���*"������V����i��9>��YX�T^�:�KY�ʾ�"/Oɽck�R}ѽ��^[�/��[��G2>�N9v�Q ��� Rz�NM����YO>]L}{8�[L�P���xx1�t�VK{ X��D:�2AM��Կ�d.\?�F���ย� ��u��]_�p���,�]2}A��K^GL���Mk٫��n,0( �Y�Ea��kuO�A4�Wd��ۃ42��$ـ9y}���WBq,��Nː��5I����'�l/_��G����I`EXc]N���
Behavioral task
behavioral1
Sample
aac8aaa8f99004970375bf8ac7fada4c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aac8aaa8f99004970375bf8ac7fada4c.exe
Resource
win10v2004-20240226-en
General
-
Target
aac8aaa8f99004970375bf8ac7fada4c
-
Size
720KB
-
MD5
aac8aaa8f99004970375bf8ac7fada4c
-
SHA1
9ace6a3738953add22ab3e44809b214e5db87e34
-
SHA256
410b052a90050f7c0c44776040bfffa381f84f3f84ee8772fb2507ae7bfb3f27
-
SHA512
f4ce45b91be478dfcca410ab996c5a9cf30b9f22b3dcb321751da4d0b537974215fe77143149319aa1578c5cd857e054a7e84528181362c36954958bef5b4478
-
SSDEEP
12288:cU5WXW4lMiCf8Rz5IW3wMNwM7J7gRc+JgJ/DzzxbpzE3oRZ:X8JM8RFIWgMp7MvJKHPzkuZ
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aac8aaa8f99004970375bf8ac7fada4c
Files
-
aac8aaa8f99004970375bf8ac7fada4c.exe windows:4 windows x86 arch:x86
3b96cc438968a5c623398b292c4bf097
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord616
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 708KB - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE