��u�D/�#�vL�����ΚvI�-�`ԝzu�M�?-l�R�s�RT5,��7x |��p�7`���7]����K�S~@�ց��Y=�B:�'�܅��_����n(��1�]��-��,]ʑȥ-"�J�t���U��������i� �q?s/!�\XTj�bu$*k�B6�7�{�d_s�8�� ]}�[�} ��^����.v��W<��_g��3za� �2����9ZNg�VU��{G�2��~��[�Mj�ֵ9;�������2����,�f>]�[�v��K�ଆ&Ԭ�;�*x,B�_�Tt뜕+A�壦��ng,N|�Q�P��Q����X�H�O�j�\�@�����w���v ��T]�=*Z����5�s�����A�ᴰ�s���N=���SS�b���6OD��wT>�iYH�`U��u�|�R��G�g;��cJ�VIpp����Y��Р�`�=y �a��m�e� ^4���� �ɦܤ�%���|tv�Ȟٲ����\T�2�dOYo9�M�����z�B�����8)�(G����ߒ��q���}���(�V��E N�*.̻�X_��(���䎤�/"�g�,��yY��,���U���R+I���m�%�o�P�!�+�Ǩ���s�¤��W#���p'k����|�Řǡ�oPp� �7V����d��vh�q�g�1�&��ծ�@ /L��}j�R�V>��C��ή��Hv�ۥ{P̀����UU���BV����~��d[X�l��Hů�貧��=q�W���۟�>��� �m%������ h�yڷ�����)��~�6�Oqȣ��pb�����2P�d���rB�J�N2� �nJ�$�,. �d���i!�[KЇ�BO�Gp�R��7����c�!9���#Y�c�!���Z�X�����5�̈�k���hI52�{1A7L�xQl��Σ�4�wH��D�?������i��x����S/{��Aj�� ��旓t�,���� .3ж�c�Q)8����M�= d��cҎس�m�Կ��\���M���خ]���萡�<W�S%��Etz�O�g���ZZh�2����ݞ�wEQ,6��'m!jw���1�f��̇Ҁw�#��wǃtH8�u�Z1���K�4�`�B�x0�����G]A#��������/���D}�FU�z�@n2Ժ��zg�_�K���Y�'���bt�/������AEy[����܄�J��J��1C��L3����hr'�&�I+�&;:��R�U�3�p�������G@��y�$��3�к�F1���Z�|�����3���Ւ.�24 �>(s/�\q?�y��G3��CIn�S���y��H���!���/ոbY���lg7%���S_6<���lx��\I�����*� ��Z���X@���ϰ��pF��#JD��:߇��\,1�Y�zCq����x7��A¨����)�{�x�{=e�,-������� �?B8�mM�4�����ZE�@�sA����*d<b���h����$��K0LQr�+��Ty��\��j�3su�w�Q�e�'��9�d{����qj�6)��V�#.��G�%OFyv���,r��D�Bɍ�iU����<�]y6���2�ƭl�X����H����[�������p�ku=;P�l��)̣~�������x��6� ���*��M��^� ӟ�.�Y0����5�:o��a��p!�����<ƯA l,,��U�HOĂ�w�qf��D}38q��e]�v��$�C����;�O"��La J���p���w����u�]}�d�2b,��I�ԑ�|tsd�|]ҏ��J]���φ8yh^��o���X�/V������y|�TB�]E�����ZaW�4��=���[�F�Lܨv$]���d��o���m��"�~� [���D蕒K�u�{�*�����?�HA�<^�*�/M����SL�.V��H)���:�:pչ.G�C:m�JO���ڄ�:�] Q�{:��go"䔑mCӴ�\;��Í���U��^��ϔ��$��<�G&��D����aق��K =�ad�L^�u��x䆛��%�0���?��w�?Q�t�ۻ3��G��Hv�E�p0=ou�8��xt�N�KK��s'^�h���"]��@�\ѳ��k_�m��Q���AIq���t�kؓ�~�m��e����!�"w�����X���B�J���qT0��7�O�j�'��%pK�h�q����$f��$'�u�`�E,;6����'�L��k�ű�un������= ���)(�f�����oW� d�v���6Ѐ�[w�IN4g�o㟭�,C4���:Y�ds��Q�i$���l�1z�P��=�aSl$��E������}J&��uR�oѻ�+��q�0���h�+&���ҿD�}k���e��d&�A\P�5vW���Ēeꄾr�5"/-x��thȬ*D���b%b=dݰ�l������n��*e�p��g�K����GV|}U9�<Lv�W!��4�(�ʯ�a�1s5���?<n�v�it�?K�,� �k 6�����o}q3IIV�L��Z[�IR�U��[}�T><"��<w��gh1��g��8��#�5�X�-��l��F��7q%��1tx�'Ȱ��| �ݒ+=1Ι�o,��E���=������������ݛ-x˞GU��U�;�����=��ZrZ���"��vQRZC;�{�}�e�����io+��j�����z�F�����:�f��}�ق�)�n9�qƀoh=�������dݠ~1J����-�wDF���v�|�X�%x|��q���)���p<��%(�<X�������l���c��ǰ���M$��t:6�T��XMqZ%�0:�/I>���u�2'@��J����I��"2�+5������طig��(U��|��Կ$苳w�m�>��a�t�h��Р�T^Ht��V�̊/w�����{�8���rZ�|��I-�25���0$H��F�^�@TE}%�h>�/�?� kWa�6����y�4����?�B.�HN�;�� B4�V�(+��ļ(�{(h�H��,�!D5���
Behavioral task
behavioral1
Sample
ac383d1d1be442cd134670995b07b219.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ac383d1d1be442cd134670995b07b219.exe
Resource
win10v2004-20240226-en
General
-
Target
ac383d1d1be442cd134670995b07b219
-
Size
120KB
-
MD5
ac383d1d1be442cd134670995b07b219
-
SHA1
cd98dddf7acdc36d4fc933bd83d2e228fbbe37b8
-
SHA256
e0c168cf4cb0662302c3c6587da3b01d2c0a7f3d90d7e02cc93e33798ffa31d3
-
SHA512
4be8a3d8488e89961cde62ed2b4059687201ade1974abee131f983a33963da4eba132542224a9baf4c1da2154492e6980446f66e50361cbb0bd2ead6d0fda1cd
-
SSDEEP
1536:6DqF5Umw6xZXIXu2y/xNXj+9WC3dd8f2agjQHhSxPQOrU7siE6YhOFA+C3eSUm:6+FvKly/xdGVtm9wUWvI7siE6YUVCzU
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac383d1d1be442cd134670995b07b219
Files
-
ac383d1d1be442cd134670995b07b219.exe windows:4 windows x86 arch:x86
e593591001d4f4bb05c98a06f18a17fa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
AppendMenuA
MessageBoxA
shell32
ShellExecuteA
mfc42
ord1949
msvcrt
_onexit
comctl32
InitCommonControlsEx
msvcp60
?fail@ios_base@std@@QBE_NXZ
Exports
Exports
Sections
.text Size: - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ