�7T~E���L�AE�oƲ=Dm���3�u��s]`/��yռ��_|K���Աx��LCk��K8��9aم([� �&��������j���f���.�ǃG�l��*�xdZ�q�R�C��|���r�v+~}��C�*a}��5�*��r䉄�L�v�� E�m���ׂ/�@�VM�ڶ`���[V̼�Xt*6ٲ�*��:̮2�z�>�X`Ww�X8�9�J(e �ӫ�~R�;D�Ã_�&5��a� ��?����u���������/� ������<`H�(j����H�,L�&g:����iPN)3g��l;dv��H�yY[-� (9��~{2�{k8�U�6���� �0d�y�l�Lo����Y.A/VtH56�p-�x�\��n&��������5,��,24}8&79z|��CɌ�S�xLHi�ًڵ��=�S��H�ui@����X�%Tύ�Fzv,��u���`�a�a���7�L@,��X |���H��e� D�i0<�zj��MK��Ϙ+�Ӊ��˃<%�^.* 蠜��{�m�`�J����e)���R�|���N�uɍ#�RQ�(6�K�a���Ѥw����X���R���3v���l���^�,U��t�����ơ��e��t����O�p�B��l�E+� s\�S@��2)c��0"�&HB����5ѯ�"��6S�J��f��G}{�� Qf-��p!������_{��q ��Q,� �J��|�.��:�ja�,5������*\ա��?�B�N����c���KqM��� Ӑo�Ib~bd|��?��}i��<��%9��)�S�&]� �K62��Y�-�8�2�eS(k킖tݺ/+h�4LO��xy+>C�t�l6PYh���G���xmd�-56�t4#�����}�(%݉��Z�9��(��{�z����Q!r�fF�j�T/�Q%�ᆵ���Y�6:��^���vZ��K�ѱ�ƴ��UCS���Z���0$���y�`CJڄb�ͱ����Zm�I&����� 8�����y0%���IF��-ub�ou��"y͌�E�������%U�3��g���e>��a7�=�瞔VVܫ���+�//<#4�r��>PCmS�.������$�*5�ʡo��H�~'&B��}ɪ]�c`��u��f�ƅ�װ �B�|��V���Եp"���� I�-���E-ps���BC\���8�R���4��]g��k.��0Q���?����"iP��S����d[��v����*e}����h'q6�]�� ���@��È������\X�e�%�����ȹ.6��,Zu�~7�����U=���#�g;�~��Od���x�<��A��jZ�}����ڶ'���(~�:^Е.~�P'�<�CyzݍT3�/^L��+*Q��3^�Ku��-�� Z��D(;D٤o���Ń{V��VS�*���=1�͞qH�W�;aS��G�x�Ǭ��'��Ȳ�T�T.V��?K��R�;z��~���� Wxә�#�����|FO�=�����I�v���x��'d"�dk,L)��Ti�p��K>7T���O57�$j(�f�F���#=[��q�C��zߴ�/�ߜ�X�_#(mP��C��W�J�i�k��%f@N��b����=��5���� v�2@ �S��%�'�����G�c�>��<y^�fP�bE�MR��HhU�DVa��@1n�8x�83��N��2�=.�����ʛE_%�o�k?�u̖�J�d.�]����!H���LG�M�w����S���by�sNO�!�v&����]m wn����Rg�^A��Υn����X�D����]']f��b��;�-POμ����3s��kƽ�2�l�|`H��8�Yv�oT&���Y�z(bĂ̝Ѣq6k�R5��S�c� ce�<�L�-{�h�ꟕ �K{g�Ġ^�\ "�#�."��ڧ��~0Ώ�]�ylL M*��3�h��"���*�.e2�K~��28�N[� �еL�g�/�˟Kp�Dj����%����f�w𡭥*�_�(�ү4�4�*��Ԍ���.��lT���o���/�?�k�t̸��8]�"qP�zME�?���=q����Bp[a�J���K����^��x�3��{U�*���i��C��VDD]�<x�;�� M|se����5{�ï�� u�J�$��N�d}\3ĩ=A&��#`���H�����"��oG�|�oUn�-���}/C��Z�1'��R�Y����$�y {�����!�����.���p�ޒ��w�kq�B #ݛ���lU-��C���f��*���z�[Ŋi��W?�>���s���*�:}�+����UQ�d5�Y�^x�����\]*_рrF�nQ�Cl2F��D��v�W9ᩊ�ժy�_��w�o�`��Y獹��a�:_��Z|k�!�q��ve-!6���~7�?%i�!�[��m\��^TH�u!$٧b��6N2��t����PJe?b�o7"aLz9���9����"3�29ʖ<�鱡�g9���^ ^'�i�[j��az#.YXP訋:��(�3À�E�|H:���L��W.����Է��pm�p1��痞כɣV�%���_zœF�U��Ӯ��/��h�����R�i�e��UH��꧊�Z�8$�L��I�(3˥3�~��I5�3"���Zz5�20ԝ�;%R��\���)�����(��*#�6J��ټ>��l�⣪8�56V�tf��.�D�)������FIՓ��ؑ�26zΫ]ط)�H��G�����Â�~�F<6�y�6��YO���(z8.�M6�<�c��mGl� 8(F���p��OT��[�Q;2&��KH�<Vg:��Q��H:W�)r��)�ן��8j1����Ǡ��r�A�Z��ɌE�Z|�����Wϸ��R��ǵ~ xTnF�a�f�����O����n��ġ���ʤ"댏$j�"e�@�±z��F��Nܧv����8[�0�ſ�8���&���H�R]v7�E�k$q�!=���M�� �*����������9���_l�\n�ߋX?��LlR�b�kt�O��<�)$$�?�F���و
Behavioral task
behavioral1
Sample
aa35357857463b046b8440d11ff7cc52.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aa35357857463b046b8440d11ff7cc52.exe
Resource
win10v2004-20240226-en
General
-
Target
aa35357857463b046b8440d11ff7cc52.bin
-
Size
660KB
-
MD5
aa35357857463b046b8440d11ff7cc52
-
SHA1
9f2002153679ba2a5232292767aa5dd89815566c
-
SHA256
82046986b945f1e05e4bc1918e78f65b8716f44fe8c64b5ca1a0eda34ec146e5
-
SHA512
c3bbae06109047f880b6e41bd56efa825d4e5f29820619f7034ea0d1f9f39d4307f02b5bedd5a9862a63f070a5c606619e692c0e7cb4ab255e21f4458156d2d1
-
SSDEEP
12288:cqQirREmJ4P8+X9RN+e6YybsRlkADRY21vUAM56+:cqQirGmJ4FXJLybswGr1vUB56+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aa35357857463b046b8440d11ff7cc52.bin
Files
-
aa35357857463b046b8440d11ff7cc52.bin.exe windows:4 windows x86 arch:x86
9eb71080d109c3ab70466d5d77b36679
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFileOpen
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 414KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 288KB - Virtual size: 287KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 364KB - Virtual size: 360KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE