�;������eZjܗ��˨��Xw���<��؝I�kyC[�f� @���oT�:.�j�J9��ӿ�(I�GTЮ5��dM�)D1���#�2�nLE �+k6VB�: 3�D�qB˥{�s>m;�+���d�;����Ld��>O�r�)#�a���S ��nfE�����8�H�%H�q��'���7+J.�G�X�/|����W+��ڥ�bNx��W ��H 9ML ;㭪��I�/��ׇ�:)d!� �y�v��C?)X�>=73�W�︨����v�<ZPh ���1�����Ɩ��U����ՠ�B�#���z��b%7��H�S�S���`t�M��˩*æ�96��C���#$����?7(�ǝWS���=8t�QT�5I%kV�{�Mu2Mz�����RU���IT�r��.���H��'���O�-=����N��7�ʏ�a�=$We�^k~g,���X܌zX��R��X���Ŷt�V'�ܞk����`��**���2b��B��>�a�P��]��G�Ia)�؇�<ޥ�+��d�=�uۙ���^�#f�U�{%fy>���o�)�ᬃ��ޤ}��h���������vðԀ��Um���5�f;���mX����5�[��ci��`��^*�&`�o#SYPH�:����Zn�Nɡ�&Z��#-��s� 6DN�;A�����72�ע��Z>��ټ��-�Ɂ�P�n��� �P��P�8��|������ʲ�� ��)ZX��/��aET�89���i�ؕx�A � ��y�$Z�Jwq·�:�f59g��̽1�F=p��� �7B4�P��j���Ԝi�<�3��ueL|g��+����}G_�=��D���uph��f�y�^�3D:i!�����lоkW����������Mt�!�F����{����sI��'L��V���`I|�`���������<�t/6?�M�<�6c+��FM���)^�ͨj����D 6�zs0&�1�4�y|_����xC&d�L�!�����(���ᜡR},���b$���d�N�J�gd��J"�`) �"�u��̲$@�e�sm������i�5pf�<�sȤn� �Tb�"�}Q�k!CP ����D˽�$yh+�����Ac�x��+JH� ڲm���u�1ֵ�k�G`��8��sb]J�;gY��$-��i�p�B����u6go�z�cUg�N�� Zz�㫐��_�l0|������Z1�G�S�b�G��u�\�^pud��H��X�8���6K��$�5_}e�Jaղ�$�}�N�-a��y�i���"�3G��K�GH���,:�>s����@l��L�����Y���+�7����6�0����|OR�s������5mf�����LN=����SKtq�q�BEa���p�nL�6����`����$��2�������\z�#���`#C�]�B*6R�v6H*�oh$��6�r{�#���;�9���i*��yi�۠V�-�!�~tY�wTXe_m��2�-�Q����fڻ���'yi�gOc�k>S�|���w�(��X(�T�J�0YM����� Cm�퍒��}���Dx'�����0�,ٮ�#8�+��TA{�L{ �4/PQ55��V:bu���o',ܠ��˥}Ek�f��Bs����U�p�2!5�j�|�6+���G��=���Q�3�����/��Pz�!o�1 G�~. �F� �ɍ1Ps~]Q�?�rtT�*��9���9������P�8� �1�-&��Z�Q�}��s?ui=$��_�plhfk�F���\�q���g�J+��Gg��3�C��n����g*�?O^�/2��`,PNM?g����^M��ۍr[In[��1���veL��|�^Ij���@���7��~A�� ��p,fV����UHe�Y4{\��(=V藁�����+¹�c<��I���Z�ӰG���uͮ��p����j���"�b�x��|~4'�Ys{F�i�s���J������X�2��DЊ�\�_:K.� �,p*6A5|�=���;:[}���vpuR~��%@�Q\&ڭ�͋�7��ۂ�V��RK��TPg*��1�����CZx�ڂ����C�/�$;0ڡ6)1"6��\E{:�TZ��-��$��U���Ԛ�û�i�;@[9���$��oBeQCw<��bԂR�7e����B2�Z��T�J�� PE�d�Y�s��x�9"�i��~�}�����W�C(�X�h�N(��[-&$=Q�ҡ��u2���H������\h���c�l�O,T����=o�Zm���=:si.�0���:fÝ��\BX������HX%�[�zr�S�it^+"lEN��%�o��Z{t�ah1���R)�ZG����� ��y����&���M�IN�+�Z� �z^uD���c�Z��}�J��� Ut}�sA;� :��*`R��Lpu�N�+߬C$��}+ .6�7ݭ*a ���q�2���&�!6L2��!�p����Ϟ��53|�!fmCd�7]���0 A�Jx�8Z��[b�W��<�*fjqꢽ �LH�Uצ�A5�@\��zb����<���NQoV'�S�{��r��~$F{k�Tp�a!��,!z}+�USq�#9El������iG�2H��Sw�'L0v�����>������x Ѱ��L{P��~c�C�/p����i�N ���I~�%����K��)�!����И?p^YJ��&�vFF��K�����\�pɢ kG�@z���z[�9�Xq�r��'��Ci��s�_S�RH]�qŗ�a[��+��&���$��;rR�^o�EW��r8�J8�����<���.��!����2�eĶU����T����҉fK<�2r]y�GJ`��zF9����%�Ze�!~���l��,+���2\�<�!���'sC�����#�՞h0I3A��?D]�.1�����]�:i��I��������k {!���u�����m��bm�z?�L�� �� >cēGo2�}e�e�`��V� }�ә n�W��E}�h@�FW!�(��
Behavioral task
behavioral1
Sample
adbab5cd20fc0909bc3d5295f3a91491.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
adbab5cd20fc0909bc3d5295f3a91491.exe
Resource
win10v2004-20240226-en
General
-
Target
adbab5cd20fc0909bc3d5295f3a91491
-
Size
724KB
-
MD5
adbab5cd20fc0909bc3d5295f3a91491
-
SHA1
049a19c8634cd9f9f769df16ec756ce74c95f713
-
SHA256
82534196b00727ba64744e43eabcb0da894f710165a17521806ed49996009d58
-
SHA512
809c05fb56418f4228e5c8424070f8aa08f475fa6460a415829130b4ab81ff010723aee00b9577ac6ec0473f86bb143536b337d0340048daa28e21c0de77e42d
-
SSDEEP
12288:n4b5Qy9mdpvBsZn7opvLoD0IPEK/IzphqXrQ8v0FV2E3SuJu4VtnYvcLx0JfFw/z:nJygdppu7mLI0IPEK/gyr2E4SqpucLxf
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource adbab5cd20fc0909bc3d5295f3a91491
Files
-
adbab5cd20fc0909bc3d5295f3a91491.exe windows:4 windows x86 arch:x86
af97b72704c716e5b9494e7fc0614f9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord100
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 676KB - Virtual size: 675KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE