0�*���š?��6D�.�0$��l��?c���#���Հ�GlSV3f\�Uﳣ�-��<X�Tᨩm�������c������'��a�o�'�����*k>����{����y��\�Q�{(�;�᧔�[ ��J���vPG���x!�0�, (�ޗM�W%2dW�.ĥ��䧉��|����3`��Jl��T���w�]�R��\ ɹ@��NTn�|��xJ�������q�'�}e��� |��u����R�}z~b���0z�$�MG�K؈u��M��\0Y��z-���o�i+ "W�ZQ���t�LO,����]{)�Ǩ�ӫ7=�<��B�f��gH��WܶB�Q��o��@�� �_���%�{�F�[�΅�O�iv����f�@��s�F������W����\�/fѬ?������$k�A+a\�#>,������M}����w�s;1K|r�k{��G�W�2�2j��/"��u��`y�$ �2�t�}Yh��~Űı��$bt�ϥT��Q�e!V)�p�e�.�(�j��U�dJ��,J�w>xlȢ��K�����]��P����yJ$���Ч��̧�U4�vX�_Tҍ�.��A��Z$��-�*���'s�A�c��/���!?��4�I�F�7�7@)�KxKL���|�"���(��mװ��,��a���_�, �Md�/�2,��o��ʡ�������Np�������� �1�땸�����~�v��@T��-[�A"1q`(rK���;A����HȞ�=6En˥֜�\7L�l����J����YF���bw��ʣ�ky������|��M�)�gt���h�}�,�))�%e�A����ī�/�DG�Q�����lv;^s��Q���J�N{��6�P�=�He:�*�u��>Q����#k�����s�;Lo�;ئ';w��u��(֬�w���^������b�x>{6���a�:��ȼ�e'�&��<��:t� wC� -t�H�b�6�P�/n��i��:Gѭ�-H���_��{����DT��mxu%� V)���_zʥ毧%������@�R�_��Q��E��U���.�2l���Dq��D����I �_���#U� ���g��k�qtw�|Մ�pv�����_�����k�R�Do�*-�8�|%@�1�/��������"BK�4��ɖ��n�v��N�)AHW)zt�~X�+��Y_�4�� �Y�F��#�}�sQ��EC~hL�|AJ"��m{�y ����K�6�����v��:���'�~$4����K'*<������]9��)hY(��=�Y[<��Xv?$Qy[G�e:��'3*�TaG�R���n���x��S1n> � Kw�DXi����$��~a�֧�w��a�{S�e�u �mW҅�5��[Ba �}��2'�^$s6������(w�_r�����-x�#�k��L��ܹ'1<�] 7>A<�]9�B���%�m`H�]g�߄G�nmwH��n��c~C�֛�f��5 ��6��x2��+�.(ޡ���d�a71Z�I T�e�,�;hf��p�Fl�Y�>U��ѺrԈN�(l���af��UQ �q��NSPx.+�J��f6v@��榕8���Wؖ�'����Ͽ������4���h�(��V��T�Y��C�e| �A�������+Z�*���p?n�a�i38�f0*��STq�G�-l��������ge�I@�����T;?�N�=p:PT@�����-�-S��l�{ �f��� &���PnuY��$�h�Q��u7HI��.K�b&�q63� ,C��&�� ;D'�=KK���q����5$ ��d�̵�: ��ƐOn��n����F� �vҷ*G�EW���$�F��6G��)��d���ѱ�KX8���D�3��XciV8��d�_���k"Rx��f��.�8Оy���cL!�-?~<)C-O�ח��X���Osn��ߜ���^5/فS���C��9q� "뗍��}��}VRA�럯�@�*�#7x�GҮ�\R��ڿ���!����|� ��n�KJ��N���4:chΥ��R���E���6��������4�8�1\��pLן&A{��j�3���e�c_>�����3�S���#F���؉��-�PItDֽ*j�+]PP������!��:S�_`��\�W��9�Y�\��-�3��݆ҺfM����f��q�86��$d�W䠌��_�������d��� �nB,��z��B$�H��`ݤ�fdo�I�����$��o ��f�e�{��Q��{��N�(�����7�o����0�q��:Y^��/���&`_�N�ϕЂ6�%�����iIAފ)6_�i��Ґ0�<��q�8����`�8�^=>T���,�>R@���x�B�?ba?7�>f�R���~-W�����ĿD������Q;��_����E�=�/�y%�;[�Ec�lE&h�C�1osW p�z�}R?/I�|RI�䆕u7���Q��l��� o��s�:B�����W]��xt^z�Ì �S&����oW���h��/�w����\;`JDV=�"_ܻ[c�V��ك����7�[c��,���f'�@�|��m��������c�7ШM@�ݐ?��3�����7:�a�*�Hu����~R#�2鸎��-�+f�U� /�G��Q H�EC��o��6rI�9�!�r7� ����+� g���<����v�4��83_3~\��];NW�d�Ny�x������.�)t���W�����\I]LƬc�ǎ�4:�t~��Jv��Q�Fr��{���:���xp�9 k���BbqU� 0�����Z�8a���y[dԲD����o��#���7����ۍ�F �\��0��v�4�~���Ɋ!����J7������:������p\��(����S�����"��-�iN&aS53z�2��x3c��^yj��lb�, �V��m�y�0SH�N���n������J�Ȝ��;'2d-���hN�oL۞M'�b�n� ۥ�_�r,�'�n5Y�p��v�D����+G�
Behavioral task
behavioral1
Sample
c0caaa7c5ffa7e41a6f28897c8d120ca.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c0caaa7c5ffa7e41a6f28897c8d120ca.exe
Resource
win10v2004-20231215-en
General
-
Target
c0caaa7c5ffa7e41a6f28897c8d120ca
-
Size
744KB
-
MD5
c0caaa7c5ffa7e41a6f28897c8d120ca
-
SHA1
75337b2fba779c75f1107d180eaf276267a530fa
-
SHA256
57e9a7ef4cc62fcae524a6a0ab60bb26362c5a2cf8b521b7dc81f0e234a97a85
-
SHA512
db3a97d4e9b77810145f3051f238214af397fed68c1d73fcb594688fc404abd4889684849b9b36dda3b51998a905062d5a598af2c9ca81a0fc5ce8bf6d36b8cf
-
SSDEEP
12288:HXcQBX7QtIXeprw/Naffv2gGepM+yfX44DnRwL5qmLbIkLLRRDTBP+18YgLsRlt:HXcU3Om1af3hGcM7fzDnRwFq0vLnVP+l
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0caaa7c5ffa7e41a6f28897c8d120ca
Files
-
c0caaa7c5ffa7e41a6f28897c8d120ca.exe windows:4 windows x86 arch:x86
17fc8148a83e681e1ed618805c628c76
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord598
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 684KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 434KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 732KB - Virtual size: 728KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE