0K���|�^�82rb6m��Ea���J��u�I.�qK��A�4��F��3�[�_�09 �s���1�Zx�f� ��0p��`�q& ��$�U ��:�K��{6��b��$�ǎ!�D�1�����reQgy� �Hc��TVR�/�s� -g�~�f��&Ͻ���=XKd�ȼ���a��l_��8y�0����gC����Nf8ϡ�d���3��PX~w�EfR �\x���~�|��уb��BԳ��eN�]�Ɖ����nZe�:bd�zp�1����W;�t�9~�p�Kx�lc��]c�i%�N�� �wOy:��,tz>���ES��4Jg� �ջ&Gz�$�2\�,Q3"EU,�A��iL���u͖����qޕ�"I��k��v���~��I1�&f!O��4�ċ��@�89Y���>(h����y�'�����S��:�l^@{��N���J J�_y j��(h�R�r�� Jt��n�ĝ�l�-�W��A�<aNH�,7q8)Ԛ���[�����A�#�����i��������a��m(�#}��߽֧���k�QI�Hmi��&�Ff�:B��� ���]�R%��f$�r 2\�{��6��a-��%bb��tؘ/v�%_���qq9�e��X�G� ��� a���|�I��Z ���érj��O�ܴDG+��Z��� �z�7��Ұ�P�����t%�<�<np��'�����ۣu��O�-Wd�4nP�%h/^�YL� ``�3��槢�Ę���/���B�D�#-�g'}��,u�b�EC��Ti綒�B��#wک�)Z�;�ϓ[�Xj���I�*�n�?��1P�Y3�<ߜ�f����9ܴ�����p��S�P4�� >ľ��h|�*XQ�����Xd���3������ ݚ���żQ��������W�$#51�r����m�Fb z}�0���2 �9��ʊ��J��ю`������Or���bҺ/��S?�)ׇ�������:�a��*�����3,����������z�8V8h*�s��v�G��^۠��ЎU\ �_�id}M���Δ0�q���*�H)_����d n�v� P���� ����t��+F �����#2���<�yR�Z��&ͩ!�`p����\�-�C��k��^�SI!q����@���3�� ��/z����v]�L�v���7��j2V���w���$o�,��O�yl�W,����]�D�d)�IZ����f`єE~ a Z��Y��rD��y/>�� lW�:>%To �>�`��|PV� ��"\h����ښZGf�1�l���%�q%G&�UZ#�¸%d�9�H�����%D5�w)R/���]l+�>��ms4����-s �^���j�$=6h���9�Lj��9��&��DXP�ö��P{9�G�c�<�J#�i*�DǦ>HX�Y㬉G�3bGK�J�N'��\o89����� �zg�W����ö���l��b@I�SKe�CH+���3�V4,�1=�etl�RE�9[a�0�z��U���B|�!.h�o�z �fy����߱���Yg�����>����dݯ�gG��9W����Y'�Ӏo�]�����g�֫%�����Q$ϺdQiw�p�K�ᶜC�\��DTd+��!xR�����~c������9���#�a̶�Dkҋ�Q`�?�FΖ�UhU.PF`��1�U�Z�%5Ù�Q�A��o���R����Z��_;��U�fD������m��1�/#T{et�z:3Gp��sc@-����}�4��͙m��ù����6B���ёꪖ��nU�@{��P�p_�4��r:��ƨ�yw���5���I�ˡ���o`�[ay�|��H��� BY��4�m���xU+��\�P�jZ;�H�, 2mz/zV��D��@�xm���^��-_�M�;@���DPb!%� J��U�s4@��T�G��(%�Q���,�8�;e��#D+<�Ѫ�P�M����ůq�>Y1�ȅҚ歔���s�o��D�UZ}q@�#���)"r�7FgU�Q�����X���Š���ǾI�������U��f�OL�i�.B��,ݘ��Ü�]i��,E�U5��������l�Gt�ۚ�6�ێbN�7X��[a��N��XӪv�����_>,�L��~�'��=��oa��H9䐑 A:�TVg6�/݆85�c>����� l���w���=[r��D����7�����}��塮�X$�4���m�̨1���-�τ=w4���:T�b��gw!*��*�O�ڳ��{��=��ڔ{%��s����j��{�`��A�Q�g�@�_����Iev�<(8�AR�Du[�,��"&I����m2�֟��{�����K�xR�OȐ>�v}�H���nə�K1�c�[�Y�Ƶi�_��� � 26�ǃ!�����,�:��q�c���K��5K� � �q��h� {!�}���T�� Z�î��KF����!��Qc��G�Y�UE���'=�#?w�?.�Si�1Ah��7n�'��O����ل:����z|�"��a|"<%��a2U��,K�n'"YsZ�q.���撦0���&���J[BZÖ� ��]A������j�p������?�1��^L��d�ZtCD�T�v~��a�̛j({fU�����Ln}�L}��٦7jJI�P�DT��}�j�)�h!��=����ܰ]�*�6@��y��Y P�n��{����UO8%L���m��egY��i&���&���k��ūCZz��������w�Y�S�LV���Jɽ���@�i��b�Za�z��*]�<��a�q���&F7��M}Zk�`R I�{u��W<k�Ncy���P| ='�� �c����n2�2U ���5f��N���4�ę��2i�Eh��4�E���pxv8;�kr�zD�h���6�,����(�"숏�J�n2?�5�i�\�� ����dZ��;auy%^q&�N��E���\a��ۤ%�`ղ��FzpFq�CE�n|3�:��'L�x��D����� å|�Ջ��
Behavioral task
behavioral1
Sample
ba5f858a6ba1f04a7da1e68e178c65b0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ba5f858a6ba1f04a7da1e68e178c65b0.exe
Resource
win10v2004-20240226-en
General
-
Target
ba5f858a6ba1f04a7da1e68e178c65b0
-
Size
740KB
-
MD5
ba5f858a6ba1f04a7da1e68e178c65b0
-
SHA1
1af2dea8f37258209f6d1f947e4016f056ddbbc6
-
SHA256
e10495c5ad629473ae2ae76772bb79c97658f5e7b39f94c58aecff5a5fda80dc
-
SHA512
a1659be212e77efe02acb6ab41d0278e9b52ed39384eba76f87f79beb9d6437ab01184f162f847e0097a72c6002bfaef731f62376dea479189be4b63e2e51423
-
SSDEEP
12288:ZSOH248vFZ0EvD3DnuqbDJOgepj0sOeo9cgAQYsqhj7CH35I/cATPKqgkkHGRBPI:ZSn48vFiEv7DnPFPQjUeU7AV5vi35ETS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba5f858a6ba1f04a7da1e68e178c65b0
Files
-
ba5f858a6ba1f04a7da1e68e178c65b0.exe windows:4 windows x86 arch:x86
c1f0ec2929fcbc398073dac131e7cc16
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaExceptHandler
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 680KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 728KB - Virtual size: 727KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE