�l��0'�ܹ��3dMW���W��{9 ��{o�h�Ϊ{�Y�*�J<=�{ Ę�6#��-ꜞ;B�N�%u��?�i����A���V:)ٙ�HЅ�x�*)����o�_���������Ẋ� ��յ�t~ĵ��S 0p!�^4����� �"9L�I�+�s�����5Й���O�����8��!�W"1�S��L�m�����\0Ļ�`�� )'�y��ðul>~�d��wz��Lmj|L���V���IA������d�Q��ˡr�A��N�uvN�/��DS� ����5�>�]E��T��zK���Wbx����T������mmB�uφ�����7P'�i�n./D#K�;)V�c̛���x\W57�Q�Zai��� ����};� ^��J��z[�`O�ۧ7��s�G��v���� �"W����"��&Qs)}1 ^��/%�%5v�6��A�� }W��ݱ������ ��Ѝv;���Yb�2�b�W1;~D�{;UP��&��<q���7��2K4oxP�4�x&�����0���7�t �^w5�;����ݜ����/e)n��ʪ���#���Ij�z��Z;�3��"��}����v~�O�EDi��q����{�y��_8���� ]�V��vz��2��!9^WGƗѤ*(�y�+@жo��dV ��#���u��� �(l�"��d6~<�+% >K�S��Y���D$j��2�B���o���Hɢ= �]0�����F.䐆����o��khV�p�j,7R����|�{g�Bji�D�ìT>Q��/�H����&��_w�Rj-:G�}�H�8�Ý�;a��tc�����*�%,#ֹ�[���CS�6���c[�1�?ʄ�Ǥ��ـM�$'sCƍJ�CW}����}q�A=����RF/�RbʹE@��ܧ�FU�a�Vk�R��ܯ8/Od9Z��ş��;�F<X�(�2�>����|z���aK�r��\jnG]� �b}����4��֖�,���+Xc���@٭6La8�=C��x�2mYS)?���.� ?k�� x�H'іp�.��8�.�J1�~v�p�u0��F@�e�߷̓M���T�u���(K��-A\C�|�Ɗ�3��b�p��Ԛ`#�Q �o��,4D�J��#��R�2`V��U<���)O��^u$��Q.. aվ`f�1 ��| �3B�PٗZ�lƺ/��<\�f�S��)����V��gE�P�dB�njԖ� Rc(c����氹�Bd�D�'�z������z��g���H����<��>g쀜!A/@ ���V /���r��D������p��ք��i$�=��}�bz���\/&�a��D9Rv��e�ڈN����$�s_�p\<=9 &g?F�y�창�528� ���c$�V�%͑9N:E����:�ѿ>�j�d<| k���J����� *�"���È�C')�����9Wx*��5@x�N)�G�f�ǻ����|v;>*:$ճ �!�J �����(%Ԁ����{��t��<J���s�xB���<N�����$����W^����%UEH����h���o����S�=O�m������c#��m��x�Hn�7������|����^�J��#`%˹��)7^<����"5����Ɯ�f�t-hv� ǂ��A������2����À��Db�������QXC̔��Y�������6�ř�az��/ȃ�}Ѷ��t��uUC�ѕ����Ǒ� ������2��Αy����"�%�fs8R0WSn�Ӟ�r8���$��z�8�R��c �?x��U7�T���[Eu�uF=�]��&�;T#�C�r������H0@�u�Ch�`�tt��������Zm��F�Te|�h}�r��'mm���kI��M��$���A(6�?�]�R�����0�Fw�LEe�.g�sX����"� H��6]�����?r0Ÿ�Ռw%� jeٰA1�9���F��`�w����z��3�w`Qp]5MĬD ˆ �Ӹ� 鈨��2���e$���RNnS�+\��j����[c+LO@Ft��Ӌk0�;�<�4��[:���v��$UP�s��δ�D����؇�ۉ�7e_d�K�&!�BuGU; ���K(�D�>P�c��>���n���O�i��D�1 ���YoA'>��|����N���3@V��$��Kk����F,(�&��-�?k��x�C&��H�S�C*��`�p�?t��H~$�^[������n=YA�e�8��~�~F��,,+�O��L�6ԓ�����������3<��d�䉸[�h�M^&��y��~z-c)����w{&1�*���7 ����Q���%]��֡qv����:��� ��E���}�9��z�R���&`���A��Q���~�g�_[�������U��vk��ʣ�8��Rl�q�b�*�r��$ ���x��8�kGHf���#�)�I��g �z������Z5�m�?�� 2iLJ�.~�T ��'F3��G��� �wӂ�c\<M�Qv<�Ϭ�~�XD�cA^5�BX��eI����ӣ (����&ָ�t���EՂ4�V��l�|7ys���gT�ς2vH��0)�l��"A��,J%�H��>ɂ8�bx���iA����K{�LmX ��� >��#�K�@��ך��W@)w%K2j8{����"0�m}3���VY��y҅K~�l_jc�F�O����r��]��1�64;ش6 ��v�젔�V�L%I��&�&�Gt���%-V�B���~���b�λ��q�yv��.���jɗ�Y(�$��Vͯ�|+"��݊A�!P�LJƏb����7�Xg��'�-�%,����v�B��Ԏ�9�ݍ�G�q�Ó��{.L��!�xG8�[�.x�*�,�!��Z��Qٔ1z���D���>��N��Blw�<J|ee�2dH,L����1;Ю���l��;���o���zV0ZQ�V�H;����E�5�v��8�D-�q�{���w|���������+�42���Q]��i�\ss�r��� ��r�=
Behavioral task
behavioral1
Sample
c0f504eaf8db9fffeca8a3156b09cf03.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c0f504eaf8db9fffeca8a3156b09cf03.exe
Resource
win10v2004-20240226-en
General
-
Target
c0f504eaf8db9fffeca8a3156b09cf03
-
Size
2.2MB
-
MD5
c0f504eaf8db9fffeca8a3156b09cf03
-
SHA1
af3cacdc0f849ba64f9d898e3ad5f92b171472db
-
SHA256
52bc292d7eda926b3257efdc665b77a002ad4a63c40d3de5375d8a336319cbe5
-
SHA512
08c93f79b471c26aadd356b6575f75eb50822264db24c2d0d241bcd16c864c6ef50fb01261db2d54d9e4888d704ba20c4cf1da0b72ae5814a2a2b2caf8935091
-
SSDEEP
49152:TiF/8dW7VdZAICaehDYeJdqF6jKKrwLqIuVPJ5IlC2o55:+Fuyhf6DYeJdbnropqPJOlCX
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0f504eaf8db9fffeca8a3156b09cf03
Files
-
c0f504eaf8db9fffeca8a3156b09cf03.exe windows:4 windows x86 arch:x86
5d262f3dab2997b803982699f225b79d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2385
msvcrt
_strnicmp
kernel32
TerminateJobObject
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
FillRect
MessageBoxA
gdi32
GetObjectA
advapi32
RegEnumValueA
shell32
SHGetSpecialFolderPathA
comctl32
_TrackMouseEvent
ole32
CoCreateInstance
oleaut32
SysAllocString
urlmon
URLDownloadToCacheFileA
shlwapi
StrCmpNIA
wininet
FindCloseUrlCache
psapi
GetModuleFileNameExA
iphlpapi
GetAdaptersInfo
msvcp60
??1Init@ios_base@std@@QAE@XZ
Exports
Exports
Sections
.text Size: - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 451KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ