�FHm5�1EG�nT��nN|�ˆxQi�wV�}�#6��������IgJ�re 1N���;�^ࣰS�&Hi� ��N�IBz�2}�iG3�f����}�7�PbI��A��y�j�� � �k��j��#,��F�6R,�ȩ[H�#��f��Wyz'���2�0��2F�t��Al\�О=JI�����(��"[��š�4����Zק%���v���Q�/9�����n9R�\<��Y���=0��ʢ�2]��'�!�]��P�S��*�r��?D1ԣ�� aR��d�፹.��A���ވC#�f��nf��*��x5�s���Ǎh��u���X�`���b4���3}*��?��@X��ȫ �])]������A���h?uxV�J���6�pX���8ϗ�,�P����)���s��W�%+/�6Q�(;\J#@���(1cu��;�lG&�(%�U��WO`(l��ҡ�L$� �ӈ6(_T�+������n���ƌ��+��&�1q�6� ��ݫ,Y�5�̰��U�K�˹ �o��f{����m#�OO_`��� ����L{(�֛y�Y�'4 Nc ���8:I7�g/��N��,�����T�UvQ���a.�.Է��JNΥ\��uia�%��͜]s��.��l%��{��p��SV�~Z�D��G��:_�wF���W�*s��������* �oJ��'b}�:�c�Q���hx�1Er����?���{����yS��T�d×�Ya�V�3wrZCF[�S��d�i�xL\�p�nZ˓N7SV�OP�S ���6�|�Ζ�_��̖]`����S��)��W*I����;��%��2�u.Ìc���b����~:2�/���Q����իI�^�)M���P5�A*S�5<�=Ce�� �����d�y���ߧ�CgGt�4VH��)�w^B0��ea���9��ca[�d��AI�˭�����m�z jW�9���]����"ʩ�;:��#��U�!v���͓dY�Z��5��6��_������-a��]���U�!�т�zmC�����>�{e|#Jލ���2�n�Ǵ���l��n����>:|�o�Fo�CY�f�^���>�u�Lb[R�=��C\��63�k�W�[��cGzG���hm�&�:B�\� �4�CfC�c+��s><��ݒ;$a����:��:�����T���@�v9 ���o,�?���Zk�S�0�Ap�������dM�͔�+�����5;4�/BO�d�Ӹj%���ndS����ϋ�C�ߢ�O��'�N�x�J���rK�#��p�ͬ$#ONj���g�]0]H7ZaP�GXA�uǍ#څZP5�*5,�=�= q�4��9�]�%�O�W�����������u{� Y�`��b���3,�)RRˮ�l�E��n�a��RPT�b]4��ӟ?d�V�X� q�iμG~z����F8%��'��P헴ʏE����D#�ig���4���z�[T\Z�6~��+����/A3<��"k�X�+�k�=7��?��a{�P��@�����Ư��f:���u�z��%#"L���ˁ���wi�e" ƙ�Q5����~ߧt�ä�!����T��~�W����a���7�AضY�2��}v�e��(P��xM f��,K�}g��V�h<�������&�����_�}wF����Mo�V��=ӵX�+.�YF����i������̣���ڵfo-��sl�v5��u�Gt|,I�tM�_��G���{�M*_[���K�e��(ll83�j�H�R�F�E�Q�(��a �&��5"�L��o���k2�A��UI�w��ee�A5Zرٯ�~9���2ۑk6%*���f@'��� &��=G���@x~���*�l�-�QzgqPa$�g-�@d �rQʕ' ɺ kTy͗���]�̲O���ڵ���Ze�a��M�)��&L��`P�4�+�'=��[��F"�@��"a��Q�4�)�U�] dn_�$�����83���$�b ��1D�"_���uU�1iHڇ���[A�@��8���%�8JL�0��I��a���%[s�?�&{����R���ᡳ�L ���h��8C�=��[�2��!�:��+�hrFJ�3�wg`��j�ޤ�6k�3�z�sf�o7�n���:up]��b�ن�y̯%���9�gh��c�J���r�/j?�j� ��G`��s���P]���M�,�d_�+7�K���G�ߛ�����`��I饄��8$4��<��X�R�6)��0����$¥!1��C�g�LH�C��U��L6�L���H���#�b2iG�P�� ��"�@]�V֜2ꡎ�<.ث n� ���)�������l�͈k��j� ��m&I2���F����9:�����������7�@��h/���M N�%��M+�SÅ$�� M��C���`K9�,�1��y��YwW�d,xȲ�B0c�U`�ᝐhթ�Z7���]o)|$Ds��E��U;Τ�9f[�4��$��~�o���=$]ւ�V�)<OC(e2���3�˘֢N���>Y�Y���5@���U�=�h$o�Ʉ�J��;� ����Cr+�� ���[�����~>F���~� �Hw�P�q���GThj4��8y���̑��;�ݧ/��1`B<����.A ��j2 N~��̡�,����s��^Cq�Am��k���]��ҡ��d,��C��.����x��?��3\��}Jm��|L�l���&c�h\S�ts��]�;JۢPR5�{�f�a�䶖q]�G.�?�o:с�Ű�9{? sPA}X����&̏��A�i`i÷lv���}�ڎʤ�m��7�7�%��GaΓ���Ez8͟��lŤ����y�{�g�Y��"���ۓ����ӥ~�t�+h��AL����/�_�^!칞��Y��W(9t |`օ�D���]���a�MU�����h3[�s����s��|����Lb�eC"���K9���.��+���ꍸ3@b�)x�J ,#�u O�C��o��ɇS)�@��A�;����i�I�� �Q�� �����"���g'B������3��� ͵
Behavioral task
behavioral1
Sample
c3454768f9281177798e83758a81a7da.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c3454768f9281177798e83758a81a7da.exe
Resource
win10v2004-20240226-en
General
-
Target
c3454768f9281177798e83758a81a7da
-
Size
556KB
-
MD5
c3454768f9281177798e83758a81a7da
-
SHA1
3a3d7ba7f12729b6a43b3abc42c55e3b6c8d8255
-
SHA256
c3c317c693959e9d11f36340ab3f360d1957d104e38a2a87d70811bc1dcdb78d
-
SHA512
3897ceaa4d5dfd2229765531a94d58741f69da46ccb6957291dbe2cb2da1fe3612bdf23c62c85784334f4d3121869c6ea03f70016a8b77a930827054d8fe787b
-
SSDEEP
12288:kOHSTKogiOVPpSwqnkY1H2GSnHAOztmJ3fByCCSMltzyy:kOyTK4aEwqjS1tafByfltzyy
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3454768f9281177798e83758a81a7da
Files
-
c3454768f9281177798e83758a81a7da.exe windows:4 windows x86 arch:x86
4108466851d273ee594a25949164b3a0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEndOfFile
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
OpenClipboard
MessageBoxA
gdi32
SetStretchBltMode
winmm
midiStreamRestart
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
OleUninitialize
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Destroy
ws2_32
recv
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 523KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 528KB - Virtual size: 525KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ