��c�)��ϣq}̈́�!������쉔H��p�Y�h���A���M���X,��>�RA��7ߥx�@ ��GUb۽��'������S����a��^����~�P��I�\̇4�@�G��۟��.�ˌ�b� "H��w����|�L����� \N+���2N�M�����SU��z'L����-gO)���9�%��`����V��~��*$����}���-#��i��������À3fڬ�2���(_nw���[�~�}� BWn��,���>C�U�S����ۿ��-�ݻ,�My���j;�i��65��u`8�9�����ƕ����6H��ѯ%�G��� ��{_�����>'yImW]�����q2jD��� ��̉���8��Yܴ�,y�ꙛN\V1�������!Ǟ�}AZ�����1�Vu�QN�s_�O���<�Rg7L����#� �D�0��[� ��#�s��J��D,���x����xHT�"&~�rCf�� ��"6ޯ�¯P������6�zh�J��V�a-f��g.{St�(݈`�T~e1OB=%�C�U������������BsJ��G�����-���_Bʢ��,QC(����q]8 X'(@@��]���Ɖ.�˷��Va�_�GS���Z���8��K&.�̰�mo#��c0��� 0EE��c�a$�������Cfܔ�f��hR tb~^wc�K���9�����Ȉ�f��p(p/:d9#ڶ��{���p����V�fY��R-Qm��� ����Gε�@`�m�|V�}4^���<��e�q (��b�������V"�k��KO}���Bt�y!ʮ�j�z�K�xM�z��)���C�ME)���ƿ������s�1��c�r����J݂���m-0Χ�K[oz��7`A�<e�ag+6����7�䲯uȪ�d���CY�&���s���y3kƲ�Pj���N?j�T��t>vh��2*�}�e�@6�7gq�J�;o#��Q�d3��rF_:�����5����f�FW�?6M>��zYm�������������|,���/1�r6���$��Npc˒�5FA3#XJ(����\��6t��,�h=9��9x;SМ�9^�r�/߁Γ�����a�o[� -��<i��3��kRp�M�ڛ���v�+���y���ZAj����.�Ω��� F0�s�.�4�9��q�]���H�;�H3�*y�u��k���{����ƙ�u��N���;=�2�۫�Ν�����7q���Z� �b�Gث�L���b���ȿ@-zGl��%�� �Ȗ@��>�IV*f��.�+�56@o���j�'�%���*#����ȶ��.�0|��`i�8|!�Cޏ�z�^�{Px��87.�U��*L�Q���,�A�������$-4?�6ާ��<Ԇ`�Tg�3�� ��x�R�W>w<s��F�*�kVJ��u)vR|�O�u a��x*�ן��=S�l��|7=e� ���[�M��.~친"��ȱm��Gmx��mtS/�H����W��"��b�?�����dn�N�*N!$���}���+�$�����6�ʪ���8e1����QZ��[�m a�V�PR7��A��P9D*ET23�g�r����?�����rE�s�<��!��+P�R�B�3�3 Sp���a������P�j������:ޑ���z0,b��dmr�?� �'���1A�j�OnK��� 5��麙�ݮ��zJ�!���;j�iN��@>�r�,:��M<A���!7�@��O���l���>��m�C��C�`�h4�����Iӿ�-���î�l�����W1�2�#���u��F�l���T(���=����x��,�������퍲w�͜���}q� �7Z�WcB��綾�PHȤ!�C�Q��ʰ�S��JZ��}y�*��b/�O�87j���NP�y�� ��ej���T�z`I����fD�v����S{իඖ���a��H�Z�(�Ż����|��p���|����Ye]�m�ܸ&�v�Y�'7.sk1 �5-%G$_���紓=8 !��s7$����/T�u ��>�'�_����W�E|�`P$s�v�ذ���)�ȮO$A {y�����[�2�~�wC�ů�-��6��`�P~���r�� �kRXf�B��n�5!8�\�a&��ZU�'1����|�av� آ&��� ����̶��uv�~F�>X�t��G���9*!��6�JvU4"a�:��,�E9��<jE�q*We�k�u_�X��=���8ʧ�D_e�>e�LK��i���%L���O\�1j��%���=��L0 ��c�x3@��89���c2nq������h/,��|;��)�K� y��~��}�d�Es��'�`�B�X�u>�/�ll^T@?�[XI;���P/��9~%м0� :}�+�n�]X@���ė�m����p���I ��jx�=���\���g���/ �ƺF�E�y(h��˽3�8]����.te:��<� 4�p�A�o��u-qs;!P{�J7e�K�SU� �����w� �l�g���R��R]Kk���B��]���7g|�Y&�,�Z4�݃4y���|#Y����XWg�=%[�NG���) � ~r3��ԑAS �io�9�=P#dr�`ȥj��۲�(�e���L�-#d[��@Y��ƫ�����Ѿ����7�}}]����&����+6}��74^�mŐ�Z�J]�o��:H݄Ǐ^'�� ��n.4��>�DKᄮ I"HƧ"�yu�iHkB�����#K#����\���&���LW]�{.<1����T`څ֜�r����[#�&@����q*�����T����l��ˊ&�ns����L`�}�����D�P�BR��V0���^&#�^�d���Wc;[���Mf\���s���d`"�NqZ8;=�=@\U��h�0��:�w�+6�b�Y*�W��v3?">������'\��} 禓�c���*�8Ia��h �&����v8r��th ���*x/��J�Y&��=}mO�,!s�/%lr I�!
Behavioral task
behavioral1
Sample
artifact.vmp.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
artifact.vmp.exe
Resource
win10v2004-20240226-en
General
-
Target
artifact.vmp.exe
-
Size
97KB
-
MD5
1089e5fbee281ccdae4db6ee965d5997
-
SHA1
9394e393a0b54e0e3f8e9189716343780444965a
-
SHA256
6620a7f3f2889e778ba506bc707d6dc3f38dbf6cf25ffde8821831a4a6328991
-
SHA512
4995c263d20bee4d6df05b8fe6c9b13f5be866b511fda30555b2361b99d9caed7e48d6257fad09725a27a4e30478825d78d5f791e686c4f95b58214016926955
-
SSDEEP
1536:SyKnU2qETCVTMN8VgEY6h6DFaThHSgPEStj+C0elD9utTQiF8VtijoD/nkxSQZiM:inkE0Mu5Y46D6hlpw4ktTQiFCtR7kg4
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource artifact.vmp.exe
Files
-
artifact.vmp.exe.exe windows:4 windows x86 arch:x86
19529f6a8461822a11ad5a27ac75fc26
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
VirtualAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcrt
_unlock
Exports
Exports
Sections
.text Size: - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 756B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE