A!�Cj�����Xe_�Yۧ0M�جR�3S=|a1_��ǒ�@����*�T��MN80�n�m$Da�y��cνJ�j}��ܶ��,��+����ѓy�+}��}W�T!ԀCfEm �Jg�u&������I #���(=��P�(�����4�fpRh�p���d(+�E� �F'���{��cI�kA ��൹bX<9��ѝZ���fO懶$���{�9�|L+�{I䲓\;d���^]m�AC�j0Y��P�ɩ�N��^�EE=S���*��PE�W��RF1qf��;�V́�lv�k���I��y��'urt����`l��=��6Ɖ���ηT���������6b�Ƙ]�hӍ�s�=�O�e�����|AN��Q7Ϛ��P���d�T�:[#:(c����D��7S�BƲ�m5Ǘ��4F�1\N�lr_"�o��Wt7�Ï�6�@=��M�Ԙ�'0 )$N�<�:�g�?t�3}�Vj� ���Ԡ��ZG�U��[��5MZΖ\X�/b%#�Eȑ��Ix�F�N��7�ԝ��B�&���qX���s��x������\�o�����#�s�*=y��X�sdL�� ycg�5V�b 3�����#]N��U�M^o��+�3�Ūkݣ�f���Et�m�P�3%鶌��/d�5�=���']���Q�)y��>��;5*j�୶���J�#^��������ne��I�Bc���*�o�)�*l.w��(g�9)�`�cl��7B���Fu!-Ҡ�3�9 {+.���{�HްK���_��V�b�{i<�V�/��Ę�%�d|�d� ����"�q�d���8sRöwU�]����i�f`�f��#z�`W7:�����n�F�BR���BR��r!b4HQ�W�}�2�FErM7�������Wk�֏�#���0|���V&#g�Q�W��Ҭ��Vǟ?7���.r��k\\�t�� ��o˺���dtY�/)��SV�PU��� 3\s�xB��d���YX���1����9�鄺C*4�-��"�3� ��+\�a��i4C�DwTS����_�$oS��X-U��{��D.7>�kl��Ӂ��PF����V���ͺ��6W�;y�o-��u��[j� '����v�8F+p�������'��[�~`,��9������!F9�����E k�I�sMy�����k��WD×�;3�2�L�l���\\ 0�)7��l�͐;��E9Ќ�}x��u��VԌ?��O�Z� ������q��n�R�e$�o\�[�W:Y$ĕאן����7NC�!K�����ױ[XJt�U������>��)t�uGYxA��/3n�85��|&��Lk�GF�G�=Qem"p��ja�Dl��@@�M�k�%�R�������IP��/��n�N����B�D�V��=��o���Ӛ~Y�nc�C`��4��р;���"�Q��|�c-���$�eB���t�d��8=����6va�[�w�9���E�̛ʠ�H�2�W�j��o���L6 ��&�Y.y��4f`~�!(�K8�d͉�y\I��ц)�U���!�(��D��_N�RN��\�o��K� p��t���V͚|����پ���5a�s��7�ٴ/�u�k^ �ƈ���� ��c[�R��2} �dM�"e4��bFhK��T[q�4��KD��O�����8� 1xP=lPҏ�u��Z�ȏ�:3�ӎQ��+�z��s�tT#ϙD�wl�^HS�H��������&���U���8�^#^�^I�!B�'�<De�oJ��p�a��fsf(�J���c�:fn�q+N]ܩ.=��n(gT ����7�lf�h�4"��2���I��ϛ��֤�´���#�Dg��.Z��,�v��`4�j��1Ġ�o �O�Ge��$�۩���c���8����|��b�މ1ԛ��v�'�u�Ce�y�H$K;ʉ�b. ��,�ܭz�.��h��f;�qDՂ��՝P��a�� �)���K��~ �P������������1��*��A��^b��1ޫf,g�x�N�ؑ�j��db��;SlG��K��Aڍd����}&�O;�@�P؈:W�u/(�>{|�K�Җ����� X�˕�N��4�L]e�/�uw:{;Q#���m`C�Y0!��2%ҙeG���J�d����S�_ >h���M��Ƥ� �����2{���/�7�@�-k��5�[�F��*"r�����*��#�'�s���P����_�t�B$BӁ�:ɍ�|���0'�����/B��'�,��6~����@~z_ȱ�h�hI��l<V��R~� p���E��$�N�p��O��/���s��=3#�s��\�Q��X�����H�����z��?:`P��0��Kl�馚Om�8<��N��k�-ȥ��=e�b�ا�� �0:3�`5'U���_S��'���$.T!2�Ӿ�BN�܇>wb��d!� c�?�����cB�Lj��j@߱���t�~�$�x��L�҃-ۉ~���t�zkQ!Y���&G>����1�6������Q���7�/4.�rJ��ȇ�k~l}���3~ZmO���`�2�߁�{�143K������S���qMȤp�5�h$�{�A�8���F� ե����i�$��c&��v��4�Q��:D��4̂�/,c��P�+4�[:�Rn4t��6b�r�����,#�>���R�(�Su�A�Gw��M�y��m326�S�����?��Hn-� ��D�+ u]�*�v�l�y�vD�&DY�m_���!���� ��}�ﮪPz<Cɧ7U��+�=�pt�a����������)Ϡ��^������g�7���{� ^��·Ë�D���qG"����Ժ忙1�*j�K+^q� �zOuov'v��c)���ǝ�8�3�����lF}i���(�;�˭M�{�_k�)&�Im���[1QM;#�nM;Z�b< �Do�66�! �a���"`��j_�&���9�!幩l�bfr2�G�d���}^^dg�ȓd7��T}K�Q���a"� �q����E݀��N^�M��6�i|�� ���ۖ�Ҙ���!w����^""G
Behavioral task
behavioral1
Sample
f8935a295a316e15f60fadf465383f19cf881a42ba008ed1792cbeecb21580dc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f8935a295a316e15f60fadf465383f19cf881a42ba008ed1792cbeecb21580dc.exe
Resource
win10v2004-20240226-en
General
-
Target
f8935a295a316e15f60fadf465383f19cf881a42ba008ed1792cbeecb21580dc
-
Size
1.7MB
-
MD5
905cbe650d13ecad4ebd55a7c187d37f
-
SHA1
f62fe1d774fcb1821183869839cf854daee2b575
-
SHA256
f8935a295a316e15f60fadf465383f19cf881a42ba008ed1792cbeecb21580dc
-
SHA512
75394d8b94c22dea9a1317b6a727bf0d9034cc8a7ba269d602dcaf34bd99dba9de7fde480d079c95480d50d4c21753a8876296a74daee55711d22711735fbe84
-
SSDEEP
49152:7gUaI0/EhsqqwgYE4O568AbMUEma8TZmCcBzsh+g3:7aI0/EhltHC6BXLnezW9
Malware Config
Signatures
-
Detects executables packed with VMProtect. 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_VMProtect -
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8935a295a316e15f60fadf465383f19cf881a42ba008ed1792cbeecb21580dc
Files
-
f8935a295a316e15f60fadf465383f19cf881a42ba008ed1792cbeecb21580dc.exe windows:5 windows x86 arch:x86
e3df9a977ea4b797be29251e9f3e0125
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
SetPixel
user32
LoadMenuW
CharUpperBuffW
kernel32
GetLastError
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
advapi32
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ